Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Monitoring For Persistence Via BITS test 2024-01-25
sigma Prefetch File Deleted test 2024-01-25
sigma PowerShell ShellCode test 2024-01-25
snort ET SMTP Message Containing search-ms URI With subquery Parameter In Message Body - Possible NTLM Hash Leak Attempt rev 1 2024-01-24
snort ET SMTP Message Containing Windows Performance Analyzer URI In Message Body - Possible NTLM Hash Leak Attempt rev 1 2024-01-24
snort ET WEB_CLIENT Request for search-ms file extension - Possible NTLM Hash Leak Attempt Attempt rev 1 2024-01-24
snort ET WEB_SPECIFIC_APPS Server Response Containing search-ms URI With crumb location Parameter - Possible NTLM Hash Leak Attempt rev 1 2024-01-24
snort ET CURRENT_EVENTS Successful Metamask PassPhrase Phish 2024-01-24 rev 1 2024-01-24
snort ET CURRENT_EVENTS Metamask Credential Phish Landing Page 2024-01-24 rev 1 2024-01-24
snort ET SMTP Message Containing search-ms URI With crumb location Parameter In Message Body - Possible NTLM Hash Leak Attempt rev 1 2024-01-24
snort ET WEB_SPECIFIC_APPS Server Response Containing Windows Performance Analyzer URI - Possible NTLM Hash Leak Attempt rev 1 2024-01-24
snort ET WEB_SPECIFIC_APPS Server Response Containing search-ms URI With subquery Parameter - Possible NTLM Hash Leak Attempt rev 1 2024-01-24
suricata ET SMTP Message Containing Windows Performance Analyzer URI In Message Body - Possible NTLM Hash Leak Attempt rev 1 2024-01-24
suricata ET SMTP Message Containing search-ms URI With crumb location Parameter In Message Body - Possible NTLM Hash Leak Attempt rev 1 2024-01-24
suricata ET PHISHING Successful Metamask PassPhrase Phish 2024-01-24 rev 1 2024-01-24
suricata ET SMTP Message Containing search-ms URI With subquery Parameter In Message Body - Possible NTLM Hash Leak Attempt rev 1 2024-01-24
suricata ET WEB_CLIENT Request for search-ms file extension - Possible NTLM Hash Leak Attempt Attempt rev 1 2024-01-24
suricata ET WEB_SPECIFIC_APPS Server Response Containing Windows Performance Analyzer URI - Possible NTLM Hash Leak Attempt rev 1 2024-01-24
suricata ET WEB_SPECIFIC_APPS Server Response Containing search-ms URI With crumb location Parameter - Possible NTLM Hash Leak Attempt rev 1 2024-01-24
suricata ET PHISHING Metamask Credential Phish Landing Page 2024-01-24 rev 1 2024-01-24
suricata ET WEB_SPECIFIC_APPS Server Response Containing search-ms URI With subquery Parameter - Possible NTLM Hash Leak Attempt rev 1 2024-01-24
sigma EventLog Query Requests By Builtin Utilities test 2024-01-24
snort ET CURRENT_EVENTS Terse POST to Wordpress Folder - Probable Successful Phishing rev 3 2024-01-23
snort ET WEB_CLIENT Possible Phishing Verified by Visa title over non SSL Feb 17 2017 rev 2 2024-01-23
snort ET INFO Possible Phishing Page - Page Saved with SingleFile Extension rev 3 2024-01-23
suricata ET PHISHING Possible Phishing Verified by Visa title over non SSL Feb 17 2017 rev 4 2024-01-23
suricata ET HUNTING Possible Phishing Page - Page Saved with SingleFile Extension rev 3 2024-01-23
snort ET INFO 3XX redirect to data URL rev 4 2024-01-22
snort ET TROJAN Brosql Stealer Browser Cookie Exfil rev 1 2024-01-22
snort ET TROJAN Brosql Stealer Browser Login Exfil rev 1 2024-01-22
snort ET TROJAN Brosql Stealer Screenshot Exfil rev 1 2024-01-22
sigma Remote Thread Creation In Mstsc.Exe From Suspicious Location test 2024-01-22
sigma Powershell Install a DLL in System Directory test 2024-01-22
sigma All Rules Have Been Deleted From The Windows Firewall Configuration test 2024-01-22
sigma CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process test 2024-01-22
sigma Firewall Rule Modified In The Windows Firewall Exception List test 2024-01-22
sigma CreateRemoteThread API and LoadLibrary test 2024-01-22
sigma CodePage Modification Via MODE.COM test 2024-01-19
snort ET WEB_SPECIFIC_APPS Possible Ivanti Endpoint Manager Mobile CVE-2023-35082 Check/Exploitation Attempt rev 2 2024-01-18
snort ET WEB_SPECIFIC_APPS Possible Ivanti Endpoint Manager Mobile CVE-2023-35078 Check/Exploitation Attempt rev 2 2024-01-18