Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma MSSQL Extended Stored Procedure Backdoor Maggie test 2022-10-09
sigma Suspicious Plink Port Forwarding test 2022-10-09
sigma Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet test 2022-10-09
sigma MSExchange Transport Agent Installation test 2022-10-09
sigma Powershell Add Name Resolution Policy Table Rule test 2022-10-09
sigma Blue Mockingbird test 2022-10-09
sigma Turla Group Lateral Movement test 2022-10-09
sigma SOURGUM Actor Behaviours test 2022-10-09
sigma APT PRIVATELOG Image Load Pattern test 2022-10-09
sigma Raccine Uninstall test 2022-10-09
sigma Suspicious VBScript UN2452 Pattern test 2022-10-09
sigma UNC2452 PowerShell Pattern test 2022-10-09
sigma Conti NTDS Exfiltration Command test 2022-10-09
sigma CVE-2021-1675 Print Spooler Exploitation test 2022-10-09
sigma Operation Wocao Activity test 2022-10-09
sigma Suspicious Camera and Microphone Access test 2022-10-09
sigma Suspicious File Characteristics Due to Missing Fields test 2022-10-09
sigma Suspicious Encoded Scripts in a WMI Consumer test 2022-10-09
sigma PsExec Default Named Pipe test 2022-10-09
sigma Suspicious Scheduled Task Creation Involving Temp Folder test 2022-10-09
sigma Logon from a Risky IP Address test 2022-10-09
sigma Google Cloud VPN Tunnel Modified or Deleted test 2022-10-09
sigma Screen Capture with Import Tool test 2022-10-09
sigma Google Cloud Storage Buckets Modified or Deleted test 2022-10-09
sigma Google Cloud Storage Buckets Enumeration test 2022-10-09
sigma Steganography Hide Files with Steghide test 2022-10-09
sigma Microsoft 365 - Potential Ransomware Activity test 2022-10-09
sigma Activity from Suspicious IP Addresses test 2022-10-09
sigma Shellshock Expression test 2022-10-09
sigma Google Cloud Re-identifies Sensitive Information test 2022-10-09
sigma Disabling Security Tools test 2022-10-09
sigma AWS STS GetSessionToken Misuse test 2022-10-09
sigma AWS STS AssumeRole Misuse test 2022-10-09
sigma AWS ElastiCache Security Group Modified or Deleted test 2022-10-09
sigma AWS ElastiCache Security Group Created test 2022-10-09
sigma AWS EKS Cluster Created or Deleted test 2022-10-09
sigma AWS Config Disabling Channel/Recorder test 2022-10-09
sigma Suspicious MacOS Firmware Activity test 2022-10-09
sigma AWS CloudTrail Important Change test 2022-10-09
sigma Cobalt Strike DNS Beaconing test 2022-10-09