Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Spox Phishkit HTTP POST Observed rev 1 2022-05-19
sigma Suspicious GrpConv Execution test 2022-05-19
sigma Powershell MsXml COM Object test 2022-05-19
snort ET INFO Possible PHP Backdoor Command Execution rev 2 2022-05-18
snort ET CURRENT_EVENTS Axie Infinity Credential Phish Landing Page M3 2022-05-18 rev 1 2022-05-18
snort ET CURRENT_EVENTS Axie Infinity Credential Phish Landing Page M1 2022-05-18 rev 2 2022-05-18
snort ET CURRENT_EVENTS Successful Axie Infinity Credential Phish M2 2022-05-18 rev 1 2022-05-18
snort ET CURRENT_EVENTS Successful Axie Infinity Credential Phish M1 2022-05-18 rev 1 2022-05-18
snort ET CURRENT_EVENTS Axie Infinity Credential Phish Landing Page M2 2022-05-18 rev 2 2022-05-18
snort ET CURRENT_EVENTS Possible Cryptowallet Mining Pool Scam Landing Page rev 1 2022-05-17
suricata ET PHISHING Possible Cryptowallet Mining Pool Scam Landing Page rev 1 2022-05-17
snort ET TROJAN Win32/Borr Stealer Variant Sending System Information rev 1 2022-05-16
sigma Arbitrary File Download Via ConfigSecurityPolicy.EXE test 2022-05-16
sigma LOLBAS Data Exfiltration by DataSvcUtil.exe test 2022-05-16
sigma C# IL Code Compilation Via Ilasm.EXE test 2022-05-16
sigma Use of TTDInject.exe test 2022-05-16
sigma Ie4uinit Lolbin Use From Invalid Path test 2022-05-16
sigma Process Access via TrolleyExpress Exclusion test 2022-05-13
sigma Bypass UAC via WSReset.exe test 2022-05-13
sigma Windows Credential Manager Access via VaultCmd test 2022-05-13
snort ET TROJAN Possible Win32/Get2 Downloader Activity rev 3 2022-05-12
snort ET TROJAN Win32/SVCReady Loader - Screenshot rev 1 2022-05-12
snort ET INFO Base64 Encoded ipconfig In Server Response M3 rev 2 2022-05-12
snort ET TROJAN Win32/SVCReady Loader - Logs rev 1 2022-05-12
snort ET INFO Base64 Encoded ipconfig In Server Response M1 rev 2 2022-05-12
snort ET TROJAN Win32/SVCReady Loader CnC Activity M2 rev 2 2022-05-12
snort ET TROJAN Win32/SVCReady Loader - SysInfo M1 rev 1 2022-05-12
snort ET TROJAN Win32/SVCReady Loader - SysInfo M2 rev 1 2022-05-12
snort ET INFO Base64 Encoded ipconfig In Server Response M2 rev 2 2022-05-12
suricata ET MALWARE Possible Win32/Get2 Downloader Activity rev 3 2022-05-12
suricata ET HUNTING Base64 Encoded ipconfig In Server Response M2 rev 2 2022-05-12
suricata ET MALWARE Win32/SVCReady Loader - Logs rev 1 2022-05-12
suricata ET HUNTING Base64 Encoded ipconfig In Server Response M3 rev 2 2022-05-12
suricata ET HUNTING Base64 Encoded ipconfig In Server Response M1 rev 2 2022-05-12
suricata ET MALWARE Win32/SVCReady Loader - Screenshot rev 1 2022-05-12
suricata ET MALWARE Win32/SVCReady Loader - SysInfo M1 rev 1 2022-05-12
suricata ET MALWARE Win32/SVCReady Loader - SysInfo M2 rev 1 2022-05-12
suricata ET MALWARE Win32/SVCReady Loader CnC Activity M2 rev 2 2022-05-12
sigma Powershell Defender Exclusion test 2022-05-12
snort ET TROJAN Win32/Wacatac.B Payload Download rev 2 2022-05-11