Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET INFO ZIP file download over raw TCP rev 2 2022-03-16
snort ET POLICY Remote Desktop AeroAdmin handshake rev 2 2022-03-16
snort ET INFO ZIP file exfiltration over raw TCP rev 2 2022-03-16
snort ET TROJAN SideCopy APT MargulasRAT Related Activity rev 2 2022-03-16
suricata ET MALWARE SideCopy APT MargulasRAT Related Activity rev 1 2022-03-16
suricata ET HUNTING RAR file exfiltration over raw TCP rev 2 2022-03-16
suricata ET HUNTING ZIP file download over raw TCP rev 1 2022-03-16
suricata ET HUNTING ZIP file exfiltration over raw TCP rev 2 2022-03-16
suricata ET HUNTING RAR file download over raw TCP rev 1 2022-03-16
suricata ET INFO Remote Desktop AeroAdmin handshake rev 2 2022-03-16
elastic Potential PrintNightmare File Modification deprecated 2022-03-16
elastic Potential PrintNightmare Exploit Registry Modification deprecated 2022-03-16
sigma Rar Usage with Password and Compression Level test 2022-03-16
sigma Suspicious Get-ADDBAccount Usage test 2022-03-16
snort ET TROJAN Ghostwriter/UNC1151 Related Domain in DNS Lookup rev 2 2022-03-15
snort ET TROJAN HermeticWizard - WMI Spreader - Remote Process Creation M1 rev 3 2022-03-15
snort ET TROJAN Win32/Webdor.NAC Variant CnC Activity rev 2 2022-03-15
snort ET TROJAN Linux/B1txor20 Backdoor Related Domain in DNS Lookup rev 2 2022-03-15
snort ET POLICY Logmein.com/Join.me SSL Remote Control Access rev 6 2022-03-15
suricata ET MALWARE Linux/B1txor20 Backdoor Related Domain in DNS Lookup rev 1 2022-03-15
suricata ET MALWARE HermeticWizard - WMI Spreader - Remote Process Creation M1 rev 4 2022-03-15
snort ET CURRENT_EVENTS Ping Identity Landing Page 2022-03-14 rev 2 2022-03-14
suricata ET PHISHING Ping Identity Landing Page 2022-03-14 rev 2 2022-03-14
sigma Interactive Bash Suspicious Children test 2022-03-14
snort ET INFO Suspicious Self Signed SSL Certificate to 'My Company Ltd' rev 4 2022-03-13
suricata ET INFO Suspicious Self Signed SSL Certificate to 'My Company Ltd' rev 4 2022-03-13
sigma Suspicious Scan Loop Network test 2022-03-12
snort ET TROJAN APT41 KEYPLUG Related Domain in DNS Lookup rev 2 2022-03-11
snort ET TROJAN Win32/Remcos RAT Checkin 781 rev 2 2022-03-11
snort ET MOBILE_MALWARE Android/SharkBot Related Domain in DNS Lookup rev 1 2022-03-11
suricata ET MALWARE Win32/Remcos RAT Checkin 781 rev 1 2022-03-11
sigma Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) test 2022-03-11
snort ET TROJAN HermeticWizard - File Copy via SMB rev 1 2022-03-10
snort ET TROJAN HermeticWizard - SMB Spreader - Remote Process Creation rev 2 2022-03-10
snort ET MOBILE_MALWARE Android/TrojanDropper.Agent.GWO Checkin rev 2 2022-03-10
suricata ET MALWARE HermeticWizard - File Copy via SMB rev 1 2022-03-10
suricata ET MALWARE HermeticWizard - SMB Spreader - Remote Process Creation rev 2 2022-03-10
suricata ET MALWARE SoulSearcher Checkin M2 rev 2 2022-03-09
suricata ET MALWARE SoulSearcher Checkin M1 rev 2 2022-03-09
sigma Suspicious UltraVNC Execution test 2022-03-09