Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE NUMOZYLOD CnC Checkin M2 rev 1 2024-08-19
suricata ET INFO TsPlus Remote Support Agent Download rev 1 2024-08-19
suricata ET MALWARE Ailurophile Infostealer Data Exfiltration Attempt M2 rev 1 2024-08-19
suricata ET MALWARE Ailurophile Infostealer CnC Server Response M1 rev 1 2024-08-19
suricata ET INFO TsPlus Remote Support Client Activity M2 rev 1 2024-08-19
suricata ET MALWARE Ailurophile Infostealer CnC Server Response M2 rev 1 2024-08-19
suricata ET MALWARE NUMOZYLOD CnC Checkin M1 rev 1 2024-08-19
snort ET TROJAN Quad7 Botnet - Outbound xlogin Telnet Prompt from Compromised Endpoint rev 1 2024-08-16
suricata ET MALWARE Quad7 Botnet - Outbound xlogin Telnet Prompt from Compromised Endpoint rev 1 2024-08-16
sigma Antivirus Filter Driver Disallowed On Dev Drive - Registry test 2024-08-16
sigma Potentially Suspicious Rundll32.EXE Execution of UDL File test 2024-08-16
sigma Process Memory Dump via RdrLeakDiag.EXE test 2024-08-15
sigma Potential CVE-2022-29072 Exploitation Attempt test 2024-08-15
sigma Emotet Loader Execution Via .LNK File test 2024-08-15
sigma Cab File Extraction Via Wusa.EXE test 2024-08-15
sigma COM Object Execution via Xwizard.EXE test 2024-08-15
sigma Bad Opsec Defaults Sacrificial Processes With Improper Arguments test 2024-08-15
sigma Wusa.EXE Executed By Parent Process Located In Suspicious Location test 2024-08-15
sigma Xwizard.EXE Execution From Non-Default Location test 2024-08-15
sigma Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity test 2024-08-13
sigma Manual Execution of Script Inside of a Compressed File test 2024-08-13
sigma User Risk and MFA Registration Policy Updated test 2024-08-13
sigma Potential Privilege Escalation via Local Kerberos Relay over LDAP test 2024-08-13
sigma Startup Item File Created - MacOS test 2024-08-11
sigma Disk Image Creation Via Hdiutil - MacOS test 2024-08-10
sigma Disk Image Mounting Via Hdiutil - MacOS test 2024-08-10
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09