Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET INFO CloudFlare Trace Site rev 1 2024-07-02
snort ET CURRENT_EVENTS LandUpdate808 Inject Inbound rev 1 2024-07-02
snort ET TROJAN TA427 Outlook Stealer Loader rev 1 2024-07-02
suricata ET MALWARE TA427 Outlook Stealer Loader rev 1 2024-07-02
suricata ET HUNTING CloudFlare Trace Site rev 1 2024-07-02
suricata ET DYN_DNS DYNAMIC_DNS Query to 3322.net Domain *.2288.org rev 12 2024-07-02
suricata ET EXPLOIT_KIT LandUpdate808 Inject Inbound rev 1 2024-07-02
sigma Windows Defender Threat Detection Service Disabled stable 2024-07-02
sigma Application Removed Via Wmic.EXE test 2024-07-02
snort ET TROJAN Poseidon Stealer Data Exfiltration Attempt rev 1 2024-07-01
suricata ET MALWARE Poseidon Stealer Data Exfiltration Attempt rev 1 2024-07-01
sigma Periodic Backup For System Registry Hives Enabled test 2024-07-01
snort ET TROJAN Koadic RC4 Encrypted Payload Inbound M2 rev 1 2024-06-27
snort ET TROJAN JS/UnkRAT RC4 Encrypted Payload Inbound rev 1 2024-06-27
suricata ET REMOTE_ACCESS MS Terminal Server Root login rev 2 2024-06-27
suricata ET REMOTE_ACCESS MS Remote Desktop Administrator Login Request rev 6 2024-06-27
suricata ET FILE_SHARING HTTP POST to MEGA Userstorage rev 3 2024-06-27
suricata ET REMOTE_ACCESS NetSupport Remote Admin Response rev 8 2024-06-27
suricata ET MALWARE Koadic RC4 Encrypted Payload Inbound M2 rev 1 2024-06-27
suricata GPL REMOTE_ACCESS PCAnywhere server response rev 6 2024-06-27
suricata ET REMOTE_ACCESS NetSupport GeoLocation Lookup Request rev 3 2024-06-27
suricata ET REMOTE_ACCESS NetSupport Remote Admin Checkin rev 8 2024-06-27
suricata ET REMOTE_ACCESS Netop Remote Control Usage rev 6 2024-06-27
suricata ET FILE_SHARING Dropbox Client Broadcasting rev 4 2024-06-27
suricata ET MALWARE JS/UnkRAT RC4 Encrypted Payload Inbound rev 1 2024-06-27
suricata ET REMOTE_ACCESS Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain rev 5 2024-06-27
suricata ET FILE_SHARING Anonymous File Sharing Service Domain in DNS Lookup rev 2 2024-06-27
sigma HackTool - Powerup Write Hijack DLL test 2024-06-27
sigma HackTool - CrackMapExec File Indicators test 2024-06-27
sigma HackTool - Typical HiveNightmare SAM File Export test 2024-06-27
sigma HackTool - Inveigh Execution Artefacts test 2024-06-27
sigma HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators test 2024-06-27
sigma HackTool - Mimikatz Kirbi File Creation test 2024-06-27
sigma Uncommon Link.EXE Parent Process test 2024-06-27
sigma HackTool - NPPSpy Hacktool Usage test 2024-06-27
sigma HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump test 2024-06-27
sigma HackTool - SafetyKatz Dump Indicator test 2024-06-27
sigma HackTool - RemoteKrbRelay Execution test 2024-06-27
sigma Finger.EXE Execution test 2024-06-27
sigma HackTool - QuarksPwDump Dump File test 2024-06-27