Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET EXPLOIT Atlassian Bitbucket CVE-2022-36804 Exploit Attempt rev 1 2022-09-22
suricata ET HUNTING Windows Commands and Variables in DNS Reply rev 1 2022-09-22
suricata ET EXPLOIT Atlassian Bitbucket CVE-2022-36804 Exploit Attempt rev 1 2022-09-22
suricata ET MALWARE Possible SombRAT Initial DNS Lookup rev 4 2022-09-22
sigma Impacket PsExec Execution test 2022-09-22
snort ET MALWARE Win/Malware.Filetour Variant Checkin M1 rev 3 2022-09-21
sigma Use NTFS Short Name in Command Line test 2022-09-21
sigma Suspicious Outbound SMTP Connections test 2022-09-21
snort ET INFO Observed DNS Query to xsph .ru Domain rev 1 2022-09-20
snort ET TROJAN BluStealer - SysInfo Exfil via Telegram M2 rev 1 2022-09-20
suricata ET INFO Observed DNS Query to xsph .ru Domain rev 1 2022-09-20
snort ET INFO Office UA Retrieving Content on Unusually High Port rev 1 2022-09-19
sigma SCM Database Privileged Operation test 2022-09-18
sigma Application Uninstalled test 2022-09-17
snort ET TROJAN Win32.Agent.Y!c CnC Checkin rev 1 2022-09-16
sigma Indicator Removal on Host - Clear Mac System Logs test 2022-09-16
sigma CobaltStrike Load by Rundll32 test 2022-09-16
sigma Suspicious Teams Application Related ObjectAcess Event test 2022-09-16
snort ET TROJAN ValleyRAT CnC Checkin Server Response rev 1 2022-09-15
suricata ET MALWARE ValleyRAT CnC Checkin Server Response rev 1 2022-09-15
sigma Remove Immutable File Attribute test 2022-09-15
sigma File Deletion stable 2022-09-15
sigma System Network Discovery - Linux test 2022-09-15
sigma Clipboard Collection with Xclip Tool test 2022-09-15
sigma Remove Scheduled Cron Task/Job test 2022-09-15
sigma Linux Base64 Encoded Shebang In CLI test 2022-09-15
sigma Suspicious Curl Change User Agents - Linux test 2022-09-15
sigma Print History File Contents test 2022-09-15
sigma History File Deletion test 2022-09-15
sigma Curl Usage on Linux test 2022-09-15
snort ET CURRENT_EVENTS Successful Generic Credential Phish 2022-09-14 rev 1 2022-09-14
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-09-14 rev 1 2022-09-14
snort ET MALWARE Win32/SuperDiag PUP CnC Activity rev 1 2022-09-14
snort ET SCAN MS Terminal Server Traffic on Non-standard Port rev 3 2022-09-14
snort ET TROJAN Powershell/PowHeartBeat CnC Checkin - HTTPS rev 1 2022-09-14
suricata ET MALWARE Powershell/PowHeartBeat CnC Checkin - HTTPS rev 1 2022-09-14
suricata ET PHISHING Generic Credential Phish Landing Page 2022-09-14 rev 1 2022-09-14
sigma Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe) test 2022-09-14
snort ET TROJAN Powershell/PowHeartBeat CnC Checkin - ICMP rev 1 2022-09-13
snort ET POLICY Suspicious Windows Installer UA for non-MSI rev 2 2022-09-13