Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET WEB_SPECIFIC_APPS Possible Ivanti Endpoint Manager Mobile CVE-2023-35082 Check/Exploitation Attempt rev 2 2024-01-18
snort ET INFO External Host Creating Docker Container rev 4 2024-01-18
snort ET TROJAN Win32/AdAptertrAin CnC Server Response rev 1 2024-01-18
suricata ET WEB_SPECIFIC_APPS Possible Ivanti Endpoint Manager Mobile CVE-2023-35078 Check/Exploitation Attempt rev 2 2024-01-18
suricata ET WEB_SPECIFIC_APPS Possible Ivanti Endpoint Manager Mobile CVE-2023-35082 Check/Exploitation Attempt rev 2 2024-01-18
sigma New Process Created Via Taskmgr.EXE test 2024-01-18
sigma Suspicious Processes Spawned by Java.EXE test 2024-01-18
sigma Sensitive File Access Via Volume Shadow Copy Backup test 2024-01-18
sigma Stop Windows Service Via Sc.EXE test 2024-01-18
sigma Write Protect For Storage Disabled test 2024-01-18
sigma Shell Process Spawned by Java.EXE test 2024-01-18
sigma Execution From Webserver Root Folder test 2024-01-18
sigma Tunneling Tool Execution test 2024-01-18
sigma Critical Hive In Suspicious Location Access Bits Cleared test 2024-01-18
sigma Service Installation in Suspicious Folder test 2024-01-18
snort ET INFO File Upload Activity Response rev 1 2024-01-17
snort ET CURRENT_EVENTS Balada JavaScript Inject rev 1 2024-01-17
snort ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 rev 1 2024-01-17
suricata ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 rev 1 2024-01-17
suricata ET INFO File Upload Activity Response rev 1 2024-01-17
sigma Sysmon Application Crashed test 2024-01-17
sigma Successful Account Login Via WMI stable 2024-01-17
sigma CodePage Modification Via MODE.COM To Russian Language test 2024-01-17
suricata ET HUNTING bmp File Request Returning Encoded File rev 1 2024-01-16
sigma New or Renamed User Account with '$' Character test 2024-01-16
sigma Access To ADMIN$ Network Share test 2024-01-16
sigma Hidden Local User Creation test 2024-01-16
sigma A New Trust Was Created To A Domain stable 2024-01-16
sigma Kerberos Manipulation test 2024-01-16
sigma Findstr Launching .lnk File test 2024-01-15
sigma Hacktool Execution - PE Metadata test 2024-01-15
sigma System Information Discovery Via Wmic.EXE test 2024-01-15
sigma Potential Peach Sandstorm APT C2 Communication Activity test 2024-01-15
sigma Peach Sandstorm APT Process Activity Indicators test 2024-01-15
snort ET WEB_SERVER Suspected HrServ Webshell Related Activity M1 rev 1 2024-01-12
snort ET TROJAN Hailbot CnC Checkin rev 1 2024-01-12
snort ET WEB_SERVER Suspected HrServ Webshell Related Activity M2 rev 1 2024-01-12
snort ET TROJAN Win32/RustMiner Suspicious HTTP Accept Header Observed rev 1 2024-01-12
snort ET TROJAN HailBot Server Response rev 1 2024-01-12
snort ET INFO Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain rev 3 2024-01-12