Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Scanner PoC for CVE-2019-0708 RDP RCE Vuln test 2022-12-25
sigma Potential RDP Exploit CVE-2019-0708 test 2022-12-25
sigma InstallerFileTakeOver LPE CVE-2021-41379 File Create Event test 2022-12-25
sigma Suspicious Splwow64 Without Params test 2022-12-25
sigma PowerShell Get-Clipboard Cmdlet Via CLI test 2022-12-25
sigma Suspicious ZipExec Execution test 2022-12-25
sigma Tasks Folder Evasion test 2022-12-25
sigma Execution via WorkFolders.exe test 2022-12-25
sigma Esentutl Volume Shadow Copy Service Keys test 2022-12-25
sigma Powershell Inline Execution From A File test 2022-12-25
sigma WhoAmI as Parameter test 2022-12-25
sigma Compress Data and Lock With Password for Exfiltration With WINZIP test 2022-12-25
sigma Enumeration for Credentials in Registry test 2022-12-25
sigma Potential COM Objects Download Cradles Usage - Process Creation test 2022-12-25
sigma Suspicious X509Enrollment - Process Creation test 2022-12-23
sigma Potential Data Stealing Via Chromium Headless Debugging test 2022-12-23
sigma Browser Started with Remote Debugging test 2022-12-23
sigma Suspicious FromBase64String Usage On Gzip Archive - Process Creation test 2022-12-23
sigma Suspicious X509Enrollment - Ps Script test 2022-12-23
sigma Suspicious FromBase64String Usage On Gzip Archive - Ps Script test 2022-12-23
snort ET CURRENT_EVENTS Socios Credential Phish Landing Page 2022-12-22 rev 1 2022-12-22
suricata ET PHISHING Socios Credential Phish Landing Page 2022-12-22 rev 1 2022-12-22
sigma OWASSRF Exploitation Attempt Using Public POC - Proxy test 2022-12-22
sigma Potential OWASSRF Exploitation Attempt - Proxy test 2022-12-22
sigma RottenPotato Like Attack Pattern test 2022-12-22
snort ET TROJAN Win32/Generik.BUTNSNA Checkin rev 1 2022-12-21
sigma User Added To Root/Sudoers Group Using Usermod test 2022-12-21
snort ET TROJAN Charming Kitten APT Related DNS Activity rev 1 2022-12-20
sigma ETW Logging Disabled In .NET Processes - Registry test 2022-12-20
sigma Creation Of An User Account test 2022-12-20
sigma Potential Privilege Escalation Using Symlink Between Osk and Cmd test 2022-12-20
snort ET CURRENT_EVENTS Suncoast Credit Union Credential Phish Landing Page 2022-12-19 rev 1 2022-12-19
suricata ET PHISHING Suncoast Credit Union Credential Phish Landing Page 2022-12-19 rev 1 2022-12-19
sigma Potential Persistence Attempt Via ErrorHandler.Cmd test 2022-12-19
sigma Potential Privilege Escalation Attempt Via .Exe.Local Technique test 2022-12-19
sigma Potential DLL Sideloading Via comctl32.dll test 2022-12-19
sigma Potential Credential Dumping Via LSASS SilentProcessExit Technique test 2022-12-19
sigma AWS Suspicious SAML Activity test 2022-12-18
sigma AWS Glue Development Endpoint Activity test 2022-12-18
sigma Azure Kubernetes Admission Controller test 2022-12-18