Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Command Line Execution with Suspicious URL and AppData Strings test 2021-11-27
sigma Visual Basic Command Line Compiler Usage test 2021-11-27
sigma WMI Persistence - Command Line Event Consumer test 2021-11-27
sigma Devtoolslauncher.exe Executes Specified Binary test 2021-11-27
sigma Suspicious Rundll32 Setupapi.dll Activity test 2021-11-27
sigma Suspicious RASdial Activity test 2021-11-27
sigma MMC20 Lateral Movement test 2021-11-27
sigma DLL Execution Via Register-cimprovider.exe test 2021-11-27
sigma Sysprep on AppData Folder test 2021-11-27
sigma Run PowerShell Script from Redirected Input Stream test 2021-11-27
sigma Suspicious Desktopimgdownldr Command test 2021-11-27
sigma DNS Exfiltration and Tunneling Tools Execution test 2021-11-27
sigma Bypass UAC via Fodhelper.exe test 2021-11-27
sigma Audio Capture via SoundRecorder test 2021-11-27
sigma Suspicious HWP Sub Processes test 2021-11-27
sigma Octopus Scanner Malware test 2021-11-27
sigma WINEKEY Registry Modification test 2021-11-27
sigma RedMimicry Winnti Playbook Registry Manipulation test 2021-11-27
sigma Sdclt Child Processes test 2021-11-27
sigma Path To Screensaver Binary Modified test 2021-11-27
sigma Registry Entries For Azorult Malware test 2021-11-27
sigma Windows Credential Editor Registry test 2021-11-27
sigma Wdigest CredGuard Registry Modification test 2021-11-27
sigma Disable Security Events Logging Adding Reg Key MiniNt test 2021-11-27
sigma UAC Bypass Via Wsreset test 2021-11-27
sigma Suspicious VBoxDrvInst.exe Parameters test 2021-11-27
snort ET TROJAN Dridex CnC Request - Spam/Worm Component rev 1 2021-11-24
snort ET TROJAN Dridex CnC Request - Spam/Worm Component rev 1 2021-11-23
suricata ET MALWARE W32/Snojan.BNQKZQH User-Agent rev 1 2021-11-23
snort ET TROJAN Win32/BlackNET CnC Requesting Command rev 4 2021-11-22
snort ET EXPLOIT Possible FatPipe Unrestricted File Upload rev 1 2021-11-22
snort ET EXPLOIT FatPipe Unrestricted File Upload rev 2 2021-11-22
suricata ET EXPLOIT Possible FatPipe Unrestricted File Upload rev 1 2021-11-22
snort ET TROJAN lu0bot Loader HTTP Response M2 rev 2 2021-11-19
snort ET TROJAN lu0bot Loader HTTP Request M2 rev 2 2021-11-19
suricata ET MALWARE lu0bot Loader HTTP Response M2 rev 1 2021-11-19
snort ET POLICY Burp Collaborator Certificate Inbound rev 2 2021-11-18
snort ET TROJAN ELF/AbcBot CnC Checkin rev 1 2021-11-18
snort ET MALWARE Unattributed WebShell Access - File Upload rev 1 2021-11-18
snort ET INFO Possible UPnP UUID Overflow Exploit Attempt from External Host - NOTIFY rev 1 2021-11-18