Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure test 2024-07-11
sigma New Network Route Added test 2024-07-11
snort ET TROJAN Imposter Interpol Stealer CnC Checkin rev 1 2024-07-10
suricata ET MALWARE Imposter Interpol Stealer CnC Checkin rev 1 2024-07-10
sigma Microsoft Word Add-In Loaded test 2024-07-10
sigma Potential Bucket Enumeration on AWS test 2024-07-10
snort ET TROJAN ZharkBot User-Agent Observed rev 1 2024-07-09
snort ET TROJAN ZharkBot CnC Exfil in HTTP URI rev 1 2024-07-09
snort ET INFO Referrer-Policy set to unsafe-url rev 1 2024-07-09
suricata ET MALWARE ZharkBot CnC Exfil in HTTP URI rev 1 2024-07-09
suricata ET HUNTING TinyURL to Netlify Redirect rev 1 2024-07-09
suricata ET INFO Referrer-Policy set to unsafe-url rev 1 2024-07-09
suricata ET MALWARE ZharkBot User-Agent Observed rev 1 2024-07-09
sigma PDF File Created By RegEdit.EXE test 2024-07-08
snort ET TROJAN UNK_ConsoleCollie URI Observed in HTTP Request rev 1 2024-07-05
suricata ET MALWARE UNK_ConsoleCollie URI Observed in HTTP Request rev 1 2024-07-05
sigma Windows Hypervisor Enforced Code Integrity Disabled test 2024-07-05
sigma Hypervisor Enforced Paging Translation Disabled test 2024-07-05
snort ET TROJAN Suspected UTA0178 Domain in TLS SNI rev 2 2024-07-04
snort ET TROJAN Suspected UTA0178 Domain in TLS SNI rev 2 2024-07-04
snort ET TROJAN Observed ZLoader CnC Domain in SNI rev 2 2024-07-04
snort ET TROJAN Observed ZLoader CnC Domain in SNI rev 2 2024-07-04
snort ET CURRENT_EVENTS UEFA 2024 Tickets/Hospitality Landing Page rev 1 2024-07-04
suricata ET PHISHING UEFA 2024 Tickets/Hospitality Landing Page rev 1 2024-07-04
suricata ET MALWARE Observed ZLoader CnC Domain in SNI rev 3 2024-07-04
suricata ET MALWARE Suspected UTA0178 Domain in TLS SNI rev 2 2024-07-04
suricata ET MALWARE Observed ZLoader CnC Domain in SNI rev 3 2024-07-04
suricata ET MALWARE TA421/YTTRIUM/APT29 TLS Certificate M3 rev 3 2024-07-04
suricata ET MALWARE Suspected UTA0178 Domain in TLS SNI rev 2 2024-07-04
snort ET TROJAN SilentCryptoMiner Agent Config Inbound rev 1 2024-07-03
suricata ET MALWARE SilentCryptoMiner Agent Config Inbound rev 1 2024-07-03
sigma Kapeka Backdoor Loaded Via Rundll32.EXE test 2024-07-03
sigma Kapeka Backdoor Execution Via RunDLL32.EXE test 2024-07-03
sigma Kapeka Backdoor Autorun Persistence test 2024-07-03
sigma Kapeka Backdoor Configuration Persistence test 2024-07-03
sigma Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process test 2024-07-03
sigma Kapeka Backdoor Scheduled Task Creation test 2024-07-03
sigma Potential Kapeka Decrypted Backdoor Indicator test 2024-07-03
sigma Kapeka Backdoor Persistence Activity test 2024-07-03
snort ET CURRENT_EVENTS LandUpdate808 Inject Inbound rev 1 2024-07-02