Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Potential DLL Sideloading Activity Via ExtExport.EXE test 2024-08-26
snort ET TROJAN Cheana Stealer CnC Checkin rev 1 2024-08-23
snort ET TROJAN Cheana Stealer Data Exfiltration Attempt rev 1 2024-08-23
suricata ET MALWARE Cheana Stealer Data Exfiltration Attempt rev 1 2024-08-23
suricata ET MALWARE Cheana Stealer CnC Checkin rev 1 2024-08-23
sigma HackTool - SharpWSUS/WSUSpendu Execution test 2024-08-23
sigma DNS Query To Put.io - DNS Client test 2024-08-23
sigma Hiding User Account Via SpecialAccounts Registry Key - CommandLine test 2024-08-23
sigma RestrictedAdminMode Registry Value Tampering test 2024-08-23
sigma FakeUpdates/SocGholish Activity test 2024-08-23
sigma Sdiagnhost Calling Suspicious Child Process test 2024-08-23
sigma Python Function Execution Security Warning Disabled In Excel - Registry test 2024-08-23
sigma File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell test 2024-08-23
snort ET TROJAN Qwerty Stealer C2 Response rev 1 2024-08-22
snort ET TROJAN Qwerty Stealer Data Exfiltration Attempt M2 rev 1 2024-08-22
snort ET TROJAN BlankGrabber Stealer Exfiltration via Discord rev 1 2024-08-22
snort ET TROJAN Qwerty Stealer Data Exfiltration Attempt M1 rev 1 2024-08-22
snort ET TROJAN Possible RAZR Ransomware User-Agent Observed rev 1 2024-08-22
suricata ET MALWARE Qwerty Stealer C2 Response rev 1 2024-08-22
suricata ET MALWARE Qwerty Stealer Data Exfiltration Attempt M1 rev 1 2024-08-22
suricata ET MALWARE Possible RAZR Ransomware User-Agent Observed rev 1 2024-08-22
suricata ET MALWARE Qwerty Stealer Data Exfiltration Attempt M2 rev 1 2024-08-22
suricata ET MALWARE BlankGrabber Stealer Exfiltration via Discord rev 1 2024-08-22
sigma Potential File Override/Append Via SET Command test 2024-08-22
sigma Driver Added To Disallowed Images In HVCI - Registry test 2024-08-21
sigma Multi Factor Authentication Disabled For User Account test 2024-08-21
sigma Hidden Flag Set On File/Directory Via Chflags - MacOS test 2024-08-21
sigma Data Export From MSSQL Table Via BCP.EXE test 2024-08-20
snort ET TROJAN Ailurophile Infostealer CnC Server Response M2 rev 1 2024-08-19
snort ET TROJAN NUMOZYLOD CnC Checkin M1 rev 1 2024-08-19
snort ET INFO TsPlus Remote Support Client Activity M2 rev 1 2024-08-19
snort ET TROJAN Ailurophile Infostealer Data Exfiltration Attempt M2 rev 1 2024-08-19
snort ET INFO TsPlus Remote Support Agent Download rev 1 2024-08-19
snort ET TROJAN Ailurophile Infostealer Data Exfiltration Attempt M1 rev 1 2024-08-19
snort ET INFO TsPlus Remote Support Client Activity M1 rev 1 2024-08-19
snort ET TROJAN NUMOZYLOD CnC Checkin M2 rev 1 2024-08-19
snort ET TROJAN Ailurophile Infostealer CnC Server Response M1 rev 1 2024-08-19
suricata ET MALWARE Ailurophile Infostealer CnC Server Response M2 rev 1 2024-08-19
suricata ET MALWARE Ailurophile Infostealer Data Exfiltration Attempt M1 rev 1 2024-08-19
suricata ET MALWARE Ailurophile Infostealer CnC Server Response M1 rev 1 2024-08-19