Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma AWS STS GetSessionToken Misuse test 2022-10-09
sigma AWS STS AssumeRole Misuse test 2022-10-09
sigma AWS Route 53 Domain Transfer Lock Disabled test 2022-10-09
sigma AWS Root Credentials test 2022-10-09
sigma Restore Public AWS RDS Instance test 2022-10-09
sigma AWS GuardDuty Important Change test 2022-10-09
sigma AWS ElastiCache Security Group Modified or Deleted test 2022-10-09
sigma AWS ElastiCache Security Group Created test 2022-10-09
sigma AWS EKS Cluster Created or Deleted test 2022-10-09
sigma AWS EFS Fileshare Mount Modified or Deleted test 2022-10-09
sigma AWS EFS Fileshare Modified or Deleted test 2022-10-09
sigma AWS Config Disabling Channel/Recorder test 2022-10-09
sigma Cobalt Strike DNS Beaconing test 2022-10-09
sigma Suspicious DNS Query with B64 Encoded String test 2022-10-09
sigma Telegram Bot API Request test 2022-10-09
sigma Microsoft 365 - User Restricted from Sending Email test 2022-10-09
sigma Microsoft 365 - Unusual Volume of File Deletion test 2022-10-09
sigma Suspicious OAuth App File Download Activities test 2022-10-09
sigma AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl test 2022-10-09
sigma UAC Bypass Using IEInstal - File test 2022-10-09
sigma Suspicious Rundll32 Invoking Inline VBScript test 2022-10-09
sigma PCRE.NET Package Image Load test 2022-10-09
sigma Hacktool Ruler test 2022-10-09
sigma InfDefaultInstall.exe .inf Execution test 2022-10-09
sigma Suspicious Service Binary Directory test 2022-10-09
sigma Credential Dumping Attempt Via Svchost test 2022-10-09
sigma UAC Bypass Using MSConfig Token Modification - File test 2022-10-09
sigma Renamed Whoami Execution test 2022-10-09
sigma Wmiprvse Wbemcomn DLL Hijack test 2022-10-09
sigma Suspicious Driver Install by pnputil.exe test 2022-10-09
sigma NetNTLM Downgrade Attack test 2022-10-09
sigma Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet test 2022-10-09
sigma Regedit as Trusted Installer test 2022-10-09
sigma Password Dumper Activity on LSASS test 2022-10-09
sigma PCRE.NET Package Temp Files test 2022-10-09
sigma Suspicious Plink Port Forwarding test 2022-10-09
sigma RDP Login from Localhost test 2022-10-09
sigma Malicious PE Execution by Microsoft Visual Studio Debugger test 2022-10-09
sigma Time Travel Debugging Utility Usage test 2022-10-09
sigma Azure AD Health Monitoring Agent Registry Keys Access test 2022-10-09