Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN DeerStealer Telegram Bot Response rev 1 2024-08-07
snort ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted rev 16 2024-08-07
snort ET TROJAN DeerStealer CnC Activity M2 rev 1 2024-08-07
suricata ET MALWARE DeerStealer Telegram Bot Response rev 1 2024-08-07
suricata ET INFO Outgoing Basic Auth Base64 HTTP Password detected unencrypted rev 18 2024-08-07
suricata ET MALWARE DeerStealer CnC Activity M2 rev 1 2024-08-07
suricata ET MALWARE DeerStealer CnC Activity M1 rev 1 2024-08-07
sigma AgentExecutor PowerShell Execution test 2024-08-07
sigma Suspicious AgentExecutor PowerShell Execution test 2024-08-07
sigma Suspicious Process Masquerading As SvcHost.EXE test 2024-08-07
sigma Potential Persistence Via Outlook Today Page test 2024-08-07
sigma Potential Persistence Via Outlook Home Page test 2024-08-07
snort ET TROJAN MOONSTONE SLEET APT Payload Delivery Attempt rev 1 2024-08-06
suricata ET MALWARE MOONSTONE SLEET APT Payload Delivery Attempt rev 1 2024-08-06
sigma HybridConnectionManager Service Running test 2024-08-05
sigma Remote Access Tool - Ammy Admin Agent Execution test 2024-08-05
sigma Remote Access Tool - Cmd.EXE Execution via AnyViewer test 2024-08-03
snort ET TROJAN APT SideWinder / TA399 CnC Domain in DNS Lookup rev 1 2024-08-01
suricata ET MALWARE APT SideWinder / TA399 CnC Domain in DNS Lookup rev 1 2024-08-01
sigma Remote Service Activity via SVCCTL Named Pipe test 2024-08-01
sigma Remote Task Creation via ATSVC Named Pipe test 2024-08-01
snort ET TROJAN Crimson RAT CnC Victim Details Exfil rev 1 2024-07-31
suricata ET MALWARE Crimson RAT CnC Victim Details Exfil rev 1 2024-07-31
sigma Potential Raspberry Robin Registry Set Internet Settings ZoneMap test 2024-07-31
sigma Potential Raspberry Robin Aclui Dll SideLoading test 2024-07-31
sigma Clipboard Data Collection Via Pbpaste test 2024-07-30
sigma Potential Exploitation of CVE-2024-37085 - Suspicious ESX Admins Group Activity test 2024-07-30
sigma Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group test 2024-07-29
sigma Potential APT FIN7 Exploitation Activity test 2024-07-29
sigma Access To .Reg/.Hive Files By Uncommon Applications test 2024-07-29
sigma Access To Chromium Browsers Sensitive Files By Uncommon Applications test 2024-07-29
sigma Access To Browser Credential Files By Uncommon Applications test 2024-07-29
sigma Access To Windows Outlook Mail Files By Uncommon Applications test 2024-07-29
sigma Github SSH Certificate Configuration Changed test 2024-07-29
sigma Github Repository/Organization Transferred test 2024-07-29
sigma Access To Potentially Sensitive Sysvol Files By Uncommon Applications test 2024-07-29
sigma Access To Crypto Currency Wallets By Uncommon Applications test 2024-07-29
sigma Github Fork Private Repositories Setting Enabled/Cleared test 2024-07-29
sigma Access To Windows Credential History File By Uncommon Applications test 2024-07-29
snort ET TROJAN JaskaGO Infrastructure Observed Inbound rev 1 2024-07-25