Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Suspected UTA0178 Domain in DNS Lookup rev 3 2024-07-18
suricata ET INFO Vulnerable Java Version 1.8.x Detected rev 43 2024-07-18
suricata ET INFO Vulnerable Java Version 22.0.x Detected rev 2 2024-07-18
suricata ET INFO Vulnerable Java Version 17.0.x Detected rev 8 2024-07-18
elastic Suspicious File Changes Activity Detected deprecated 2024-07-18
snort ET TROJAN Patchwork APT Malformed HTTP Request CnC Response rev 1 2024-07-16
snort ET TROJAN Patchwork APT Malformed HTTP Request rev 1 2024-07-16
snort ET TROJAN Patchwork APT Host Details Exfil rev 1 2024-07-16
snort ET TROJAN Patchwork APT Victim Registration rev 1 2024-07-16
suricata ET MALWARE Patchwork APT Victim Registration rev 1 2024-07-16
suricata ET MALWARE Patchwork APT Malformed HTTP Request CnC Response rev 1 2024-07-16
suricata ET MALWARE Patchwork APT Host Details Exfil rev 1 2024-07-16
suricata ET MALWARE Patchwork APT Malformed HTTP Request rev 1 2024-07-16
sigma Network Connection Initiated By AddinUtil.EXE test 2024-07-16
sigma Network Connection Initiated To AzureWebsites.NET By Non-Browser Process test 2024-07-16
sigma Dllhost.EXE Initiated Network Connection To Non-Local IP Address test 2024-07-16
sigma Msiexec.EXE Initiated Network Connection Over HTTP test 2024-07-16
sigma Potentially Suspicious PowerShell Child Processes test 2024-07-16
sigma DLL Call by Ordinal Via Rundll32.EXE stable 2024-07-16
snort ET TROJAN Vidar Stealer Form Exfil rev 1 2024-07-15
suricata ET MALWARE Vidar Stealer Form Exfil rev 1 2024-07-15
snort ET TROJAN GhostRat CnC Checkin rev 2 2024-07-12
suricata ET MALWARE APT Mustang Panda Payload - CnC Checkin rev 4 2024-07-12
suricata ET MALWARE GhostRat CnC Checkin rev 2 2024-07-12
sigma Renamed Microsoft Teams Execution test 2024-07-12
sigma Suspicious Electron Application Child Processes test 2024-07-12
sigma Potentially Suspicious Execution From Parent Process In Public Folder test 2024-07-12
sigma Process Execution From A Potentially Suspicious Folder test 2024-07-12
sigma LoadBalancer Security Group Modification test 2024-07-11
sigma BitLockerTogo.EXE Execution test 2024-07-11
sigma Directory Service Restore Mode(DSRM) Registry Value Tampering test 2024-07-11
sigma Forest Blizzard APT - File Creation Activity test 2024-07-11
sigma Ingress/Egress Security Group Modification test 2024-07-11
sigma New Network Route Added test 2024-07-11
sigma New Network ACL Entry Added test 2024-07-11
sigma Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure test 2024-07-11
sigma Kubernetes CronJob/Job Modification test 2024-07-11
sigma Potential DLL Sideloading Of MpSvc.DLL test 2024-07-11
sigma RDS Database Security Group Modification test 2024-07-11
sigma Kubernetes Admission Controller Modification test 2024-07-11