Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Abuse of Service Permissions to Hide Services Via Set-Service - PS test 2022-10-17
sigma Abuse of Service Permissions to Hide Services Via Set-Service test 2022-10-17
sigma Potential XCSSET Malware Infection test 2022-10-17
sigma Potential WizardUpdate Malware Infection test 2022-10-17
snort ET TROJAN MSSQL maggie backdoor sysinfo Query Observed rev 2 2022-10-14
snort ET TROJAN MSSQL maggie backdoor ListIP Query Observed rev 2 2022-10-14
snort ET TROJAN MSSQL maggie backdoor whoami Query Observed rev 2 2022-10-14
snort ET TROJAN Win32/TrojanDropper.Agent.SSQ Checkin rev 1 2022-10-14
suricata ET MALWARE MSSQL maggie backdoor ListIP Query Observed rev 2 2022-10-14
suricata ET MALWARE MSSQL maggie backdoor sysinfo Query Observed rev 2 2022-10-14
suricata ET MALWARE MSSQL maggie backdoor whoami Query Observed rev 2 2022-10-14
sigma Add or Remove Computer from DC test 2022-10-14
sigma Device Installation Blocked test 2022-10-14
sigma User Logoff Event test 2022-10-14
sigma Replay Attack Detected test 2022-10-14
snort ET TROJAN Win32/TrojanDropper.Agent.SRM Exfil via Discord rev 1 2022-10-13
suricata ET MALWARE Win32/TrojanDropper.Agent.SRM Exfil via Discord rev 1 2022-10-13
sigma WMIC Loading Scripting Libraries test 2022-10-13
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-10-12 rev 1 2022-10-12
snort ET INFO MSSQL SELECT SPID Query Observed rev 1 2022-10-12
snort ET TROJAN Win32/Spy.Mekotio.EY Payload Request rev 1 2022-10-12
snort ET CURRENT_EVENTS Generic Credential Phish 2022-10-12 rev 1 2022-10-12
snort ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-12 rev 1 2022-10-12
snort ET INFO MSSQL sp_addextendedproc Command Observed rev 1 2022-10-12
snort ET TROJAN VBA/Agent.AAV CnC Checkin rev 1 2022-10-12
snort ET TROJAN MSSQL maggie backdoor sp_addextendedproc Command Observed rev 1 2022-10-12
suricata ET PHISHING Generic Credential Phish 2022-10-12 rev 1 2022-10-12
suricata ET MALWARE Win32/Spy.Mekotio.EY Payload Request rev 1 2022-10-12
suricata ET INFO MSSQL SELECT SPID Query Observed rev 1 2022-10-12
suricata ET INFO MSSQL sp_addextendedproc Command Observed rev 1 2022-10-12
suricata ET MALWARE VBA/Agent.AAV CnC Checkin rev 1 2022-10-12
suricata ET MALWARE MSSQL maggie backdoor sp_addextendedproc Command Observed rev 1 2022-10-12
snort ET TROJAN Polonium APT PAPACREEP Backdoor Related Activity rev 1 2022-10-11
snort ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-11 rev 1 2022-10-11
snort ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-11 rev 1 2022-10-11
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page M2 2022-10-11 rev 1 2022-10-11
snort ET CURRENT_EVENTS Generic Successful Phish 2022-10-11 rev 1 2022-10-11
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page M1 2022-10-11 rev 1 2022-10-11
suricata ET PHISHING Generic Credential Phish Landing Page M1 2022-10-11 rev 1 2022-10-11
suricata ET PHISHING Successful Generic Credential Phish 2022-10-11 rev 1 2022-10-11