Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Cscript/Wscript Potentially Suspicious Child Process test 2024-01-02
sigma HackTool - EDRSilencer Execution test 2024-01-02
sigma System Information Discovery Using System_Profiler test 2024-01-02
sigma Tamper Windows Defender - PSClassic test 2024-01-02
sigma Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE test 2024-01-02
sigma System Integrity Protection (SIP) Enumeration test 2024-01-02
sigma Tamper Windows Defender - ScriptBlockLogging test 2024-01-02
sigma System Integrity Protection (SIP) Disabled test 2024-01-02
sigma Potential Persistence Via AppCompat RegisterAppRestart Layer test 2024-01-01
snort ET INFO HTTP Request for FixMe.IT / Techinline Remote Access Tool rev 1 2023-12-29
snort ET TROJAN Rezlt RDP Grabber - This is Not RDP rev 1 2023-12-29
snort ET TROJAN Snake Keylogger HTTP Exfil rev 1 2023-12-29
suricata ET INFO HTTP Request for FixMe.IT / Techinline Remote Access Tool rev 1 2023-12-29
suricata ET MALWARE Rezlt RDP Grabber - This is Not RDP rev 1 2023-12-29
suricata ET MALWARE Snake Keylogger HTTP Exfil rev 1 2023-12-29
suricata ET MALWARE [ANY.RUN] zgRAT / PureLogs CnC Data Exfiltration Attempt M1 rev 1 2023-12-28
suricata ET MALWARE [ANY.RUN] zgRAT / PureLogs CnC Connection M2 rev 1 2023-12-28
snort ET TROJAN [ANY.RUN] zgRAT / PureLogs CnC Connection M2 rev 1 2023-12-28
snort ET TROJAN [ANY.RUN] zgRAT / PureLogs CnC Data Exfiltration Attempt M1 rev 1 2023-12-28
snort ET TROJAN [ANY.RUN] LgoogLoader Retrieving Config File rev 1 2023-12-28
snort ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 rev 1 2023-12-28
snort ET TROJAN [ANY.RUN] Win32/Gh0stRat Activity rev 1 2023-12-28
snort ET TROJAN [ANY.RUN] Win32/Lumma Stealer Configuration Request Attempt rev 1 2023-12-28
snort ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In rev 1 2023-12-28
snort ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration rev 1 2023-12-28
snort ET TROJAN [ANY.RUN] LUMAR Stealer Exfiltration M1 rev 1 2023-12-28
snort ET TROJAN SimpleHelp Remote Access Software Activity rev 1 2023-12-28
snort ET TROJAN [ANY.RUN] Win32/Gh0stRat Keep-Alive rev 1 2023-12-28
suricata ET MALWARE [ANY.RUN] LUMAR Stealer Exfiltration M1 rev 1 2023-12-28
suricata ET MALWARE [ANY.RUN] Win32/Gh0stRat Keep-Alive rev 1 2023-12-28
suricata ET MALWARE [ANY.RUN] Win32/Lumma Stealer Check-In rev 1 2023-12-28
suricata ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 rev 1 2023-12-28
suricata ET MALWARE [ANY.RUN] Win32/Gh0stRat Activity rev 1 2023-12-28
suricata ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration rev 1 2023-12-28
sigma Suspicious Redirection to Local Admin Share test 2023-12-28
snort ET SCADA Rockwell RNA Message Large Header Length - 8Kb rev 5 2023-12-27
snort ET TROJAN Generic Stealer Checkin rev 1 2023-12-27
snort ET TROJAN Suspected Turla APT Kazuar Backdoor Related Activity rev 1 2023-12-27
snort ET TROJAN Turla APT Kazuar Backdoor Related Activity rev 1 2023-12-27
suricata ET SCADA Rockwell RNA Message Large Header Length - 8Kb rev 5 2023-12-27