Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET MALWARE Agrius Group Webshell File Upload Attempt rev 1 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
suricata ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
sigma Remote PowerShell Session (PS Classic) test 2024-01-03
snort ET TROJAN Win32/Sfuzuan Variant Payload Fetch rev 1 2024-01-02
snort ET TROJAN Win32/Sfuzuan Variant Payload Fetch rev 1 2024-01-02
snort ET TROJAN Kimsuky APT Related Win32/RftRAT Activity rev 1 2024-01-02
suricata ET MALWARE Win32/Sfuzuan Variant Payload Fetch rev 1 2024-01-02
suricata ET MALWARE Win32/Sfuzuan Variant Payload Fetch rev 1 2024-01-02
suricata ET MALWARE Kimsuky APT Related Win32/RftRAT Activity rev 1 2024-01-02
sigma Binary Proxy Execution Via Dotnet-Trace.EXE test 2024-01-02
sigma Powershell Defender Disable Scan Feature test 2024-01-02
sigma HackTool - EDRSilencer Execution test 2024-01-02
sigma Tamper Windows Defender - PSClassic test 2024-01-02
sigma System Information Discovery Using Ioreg test 2024-01-02
sigma System Integrity Protection (SIP) Disabled test 2024-01-02
sigma System Information Discovery Using System_Profiler test 2024-01-02
sigma System Integrity Protection (SIP) Enumeration test 2024-01-02
sigma Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE test 2024-01-02
sigma Tamper Windows Defender - ScriptBlockLogging test 2024-01-02
sigma Cscript/Wscript Potentially Suspicious Child Process test 2024-01-02