Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Suspicious Powercfg Execution To Change Lock Screen Timeout test 2022-11-18
sigma Windows Webshell Strings test 2022-11-18
sigma Disable Windows Defender AV Security Monitoring test 2022-11-18
sigma Suspicious Service Path Modification test 2022-11-18
snort ET TROJAN Win32/Corrempa/HZRAT CnC Checkin rev 1 2022-11-17
suricata ET MALWARE Win32/Corrempa/HZRAT CnC Checkin rev 1 2022-11-17
sigma PST Export Alert Using eDiscovery Alert test 2022-11-17
sigma PST Export Alert Using New-ComplianceSearchAction test 2022-11-17
sigma User Discovery And Export Via Get-ADUser Cmdlet test 2022-11-17
sigma Active Directory Group Enumeration With Get-AdGroup test 2022-11-17
sigma Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell test 2022-11-17
sigma User Discovery And Export Via Get-ADUser Cmdlet - PowerShell test 2022-11-17
sigma Suspicious Msbuild Execution By Uncommon Parent Process test 2022-11-17
sigma Computer Discovery And Export Via Get-ADComputer Cmdlet test 2022-11-17
sigma Invoke-Obfuscation CLIP+ Launcher test 2022-11-17
snort ET TROJAN Win32/VB.PNU CnC Checkin rev 1 2022-11-16
snort ET TROJAN Suspected Bitter APT Related Activity rev 1 2022-11-16
snort ET INFO GameHouse License Check rev 1 2022-11-16
suricata ET MALWARE Suspected Bitter APT Related Activity rev 1 2022-11-16
sigma Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION test 2022-11-16
snort ET TROJAN Fodcha Botnet Style DNS Server Lookup rev 1 2022-11-15
snort ET INFO Trend Micro Phishing Simulation Service rev 1 2022-11-15
suricata ET INFO Trend Micro Phishing Simulation Service rev 1 2022-11-15
sigma Possible CVE-2021-1675 Print Spooler Exploitation test 2022-11-15
snort ET CURRENT_EVENTS Successful GNCU Credential Phish 2022-11-14 rev 1 2022-11-14
suricata ET PHISHING Successful GNCU Credential Phish 2022-11-14 rev 1 2022-11-14
sigma Abused Debug Privilege by Arbitrary Parent Processes test 2022-11-11
sigma Automated Collection Command Prompt test 2022-11-11
sigma Suspicious RunAs-Like Flag Combination test 2022-11-11
sigma Shadow Copies Creation Using Operating Systems Utilities test 2022-11-10
sigma Suspicious Process Patterns NTDS.DIT Exfil test 2022-11-10
sigma Use Of The SFTP.EXE Binary As A LOLBIN test 2022-11-10
snort ET TROJAN JS/Cloud9 Clipboard Exfiltration Attempt rev 1 2022-11-09
snort ET TROJAN JS/Cloud9 Cookie Exfiltration Attempt rev 1 2022-11-09
snort ET TROJAN VBA/Agent.ADT Checkin rev 1 2022-11-09
suricata ET MALWARE JS/Cloud9 Cookie Exfiltration Attempt rev 1 2022-11-09
suricata ET MALWARE JS/Cloud9 Clipboard Exfiltration Attempt rev 1 2022-11-09
sigma AMSI Bypass Pattern Assembly GetType test 2022-11-09
snort ET CURRENT_EVENTS Successful Roundcube Credential Phish 2022-11-08 rev 1 2022-11-08
snort ET CURRENT_EVENTS Successful Veridian Credit Union Credential Phish 2022-11-08 rev 1 2022-11-08