Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Successful Generic Credential Phish 2022-10-11 rev 1 2022-10-11
suricata ET PHISHING Generic Successful Phish 2022-10-11 rev 1 2022-10-11
suricata ET PHISHING Successful Generic Credential Phish 2022-10-11 rev 1 2022-10-11
sigma WMI Persistence - Script Event Consumer test 2022-10-11
snort ET TROJAN Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v2 rev 6 2022-10-10
snort ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-10 rev 1 2022-10-10
suricata ET PHISHING Successful Generic Credential Phish 2022-10-10 rev 1 2022-10-10
sigma Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet test 2022-10-10
sigma Reg Add Suspicious Paths test 2022-10-10
sigma Cleartext Protocol Usage stable 2022-10-10
sigma Google Cloud DNS Zone Modified or Deleted test 2022-10-09
sigma Google Cloud Firewall Modified or Deleted test 2022-10-09
sigma Google Full Network Traffic Packet Capture test 2022-10-09
sigma Google Cloud VPN Tunnel Modified or Deleted test 2022-10-09
sigma Logon from a Risky IP Address test 2022-10-09
sigma Microsoft 365 - Potential Ransomware Activity test 2022-10-09
sigma Steganography Hide Zip Information in Picture File test 2022-10-09
sigma AWS GuardDuty Important Change test 2022-10-09
sigma Restore Public AWS RDS Instance test 2022-10-09
sigma AWS Root Credentials test 2022-10-09
sigma AWS Route 53 Domain Transfer Lock Disabled test 2022-10-09
sigma Steganography Extract Files with Steghide test 2022-10-09
sigma Suspicious Service Binary Directory test 2022-10-09
sigma Turla Group Lateral Movement test 2022-10-09
sigma Operation Wocao Activity test 2022-10-09
sigma Execute From Alternate Data Streams test 2022-10-09
sigma CVE-2021-26858 Exchange Exploitation test 2022-10-09
sigma Suspicious Camera and Microphone Access test 2022-10-09
sigma CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum test 2022-10-09
sigma MSSQL Extended Stored Procedure Backdoor Maggie test 2022-10-09
sigma Suspicious Encoded Scripts in a WMI Consumer test 2022-10-09
sigma AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl test 2022-10-09
sigma Remote PowerShell Session Host Process (WinRM) test 2022-10-09
sigma PsExec Default Named Pipe test 2022-10-09
sigma Malicious PE Execution by Microsoft Visual Studio Debugger test 2022-10-09
sigma UAC Bypass Using NTFS Reparse Point - File test 2022-10-09
sigma Defrag Deactivation test 2022-10-09
sigma Remote PowerShell Sessions Network Connections (WinRM) test 2022-10-09
sigma Regedit as Trusted Installer test 2022-10-09
sigma Suspicious Scheduled Task Creation Involving Temp Folder test 2022-10-09