Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE ACR Stealer CnC Domain in DNS Lookup rev 1 2024-05-16
suricata ET MALWARE Horabot Payload Inbound rev 1 2024-05-16
suricata ET MALWARE Ponmocup Post Infection DNS Lookup messagewild rev 6 2024-05-16
suricata ET MALWARE Horabot CnC Host Details Exfil rev 1 2024-05-16
suricata ET MALWARE ACR Stealer CnC Domain in DNS Lookup rev 1 2024-05-16
suricata ET MALWARE ACR Stealer CnC Domain in DNS Lookup rev 1 2024-05-16
suricata ET MALWARE ACR Stealer Data Exfiltration Attempt M2 rev 1 2024-05-16
suricata ET MALWARE ACR Stealer CnC Domain in DNS Lookup rev 1 2024-05-16
snort ET TROJAN Observed ClickFix Fake Update iframe Injection Attempt rev 1 2024-05-14
suricata ET MALWARE Observed ClickFix Fake Update iframe Injection Attempt rev 1 2024-05-14
snort ET TROJAN Possible XWorm Payload Downloaded via Powershell rev 1 2024-05-13
suricata ET MALWARE Possible XWorm Payload Downloaded via Powershell rev 1 2024-05-13
sigma Uncommon FileSystem Load Attempt By Format.com test 2024-05-13
sigma Scheduled Task Creation From Potential Suspicious Parent Location test 2024-05-13
sigma Potentially Suspicious Child Process of KeyScrambler.exe test 2024-05-13
sigma Launch Agent/Daemon Execution Via Launchctl test 2024-05-13
sigma Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock test 2024-05-12
sigma Windows Backup Deleted Via Wbadmin.EXE test 2024-05-10
sigma UAC Disabled stable 2024-05-10
sigma New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet - ScriptBlock test 2024-05-10
sigma All Backups Deleted Via Wbadmin.EXE test 2024-05-10
sigma Sensitive File Recovery From Backup Via Wbadmin.EXE test 2024-05-10
sigma File Recovery From Backup Via Wbadmin.EXE test 2024-05-10
sigma Sensitive File Dump Via Wbadmin.EXE test 2024-05-10
sigma UAC Notification Disabled test 2024-05-10
sigma UAC Secure Desktop Prompt Disabled test 2024-05-10
sigma New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application test 2024-05-10
sigma Suspicious External WebDAV Execution test 2024-05-10
sigma Potentially Suspicious Malware Callback Communication - Linux test 2024-05-10
sigma New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE test 2024-05-10
snort ET CURRENT_EVENTS Possible Microsoft Phishing HTML Class Tag rev 1 2024-05-09
snort ET TROJAN DarkGate CnC Exfil via AutoIt Payload rev 1 2024-05-09
snort ET TROJAN AutoIt3.exe Downloaded via Powershell rev 1 2024-05-09
snort ET TROJAN AutoIt3 Script Downloaded via Powershell Shortly After AutoIt3.exe Download rev 1 2024-05-09
suricata ET MALWARE DarkGate CnC Exfil via AutoIt Payload rev 1 2024-05-09
suricata ET MALWARE AutoIt3 Script Downloaded via Powershell Shortly After AutoIt3.exe Download rev 1 2024-05-09
suricata ET MALWARE AutoIt3.exe Downloaded via Powershell rev 1 2024-05-09
suricata ET PHISHING Possible Microsoft Phishing HTML Class Tag rev 1 2024-05-09
snort ET POLICY tor4u tor2web .onion Proxy DNS lookup rev 4 2024-05-08
snort ET TROJAN DNS query for Morto RDP worm related domain jifr.info rev 4 2024-05-08