Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Suspicious Process Start Locations test 2022-01-07
sigma Suspicious SYSVOL Domain Group Policy Access test 2022-01-07
sigma Enable Windows Remote Management test 2022-01-07
sigma MsiExec Web Install test 2022-01-07
snort ET TROJAN PurpleFox Backdoor/Rootkit Download Request M1 rev 2 2022-01-06
snort ET TROJAN PurpleFox Backdoor/Rootkit Download Server Response M1 rev 2 2022-01-05
sigma Mimikatz Use test 2022-01-05
snort ET TROJAN Konni Group CnC Domain in DNS Lookup rev 2 2022-01-04
snort ET TROJAN Konni Group CnC Domain in DNS Lookup rev 2 2022-01-04
snort ET TROJAN Konni Group CnC Domain in DNS Lookup rev 2 2022-01-04
sigma Powershell Execute Batch Script test 2022-01-02
sigma Suspicious Execution of Hostname test 2022-01-01
sigma Suspicious Execution of Shutdown test 2022-01-01
sigma Suspicious Query of MachineGUID test 2022-01-01
sigma Remote Schedule Task Recon via ITaskSchedulerService test 2022-01-01
sigma Remote Schedule Task Lateral Movement via ITaskSchedulerService test 2022-01-01
sigma Remote Printing Abuse for Lateral Movement test 2022-01-01
sigma Possible DCSync Attack test 2022-01-01
sigma Remote Encrypting File System Abuse test 2022-01-01
sigma Remote Event Log Recon test 2022-01-01
sigma Remote Registry Lateral Movement test 2022-01-01
sigma Remote DCOM/WMI Lateral Movement test 2022-01-01
sigma Remote Schedule Task Lateral Movement via ATSvc test 2022-01-01
sigma Recon Activity via SASec test 2022-01-01
sigma Remote Schedule Task Recon via AtScv test 2022-01-01
sigma SharpHound Recon Account Discovery test 2022-01-01
sigma Remote Server Service Abuse test 2022-01-01
sigma SharpHound Recon Sessions test 2022-01-01
sigma Remote Registry Recon test 2022-01-01
sigma Remote Server Service Abuse for Lateral Movement test 2022-01-01
sigma Remote Schedule Task Lateral Movement via SASec test 2022-01-01
sigma Creation Exe for Service with Unquoted Path test 2021-12-30
sigma Registry-Free Process Scope COR_PROFILER test 2021-12-30
sigma Service Registry Permissions Weakness Check test 2021-12-30
snort ET TROJAN MuddyWater APT Related Maldoc Checkin M1 rev 2 2021-12-28
snort ET TROJAN Suspected MuddyWater Related CnC Activity rev 2 2021-12-28
sigma Manipulation of User Computer or Group Security Principals Across AD test 2021-12-28
sigma Code Executed Via Office Add-in XLL File test 2021-12-28
sigma Powershell LocalAccount Manipulation test 2021-12-28
sigma Suspicious Kernel Dump Using Dtrace test 2021-12-28