Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET INFO External IP Lookup - ipleak .net rev 1 2026-09-17
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.robertschulze .org domain rev 1 2026-09-17
elastic AWS IAM Assume Role Policy Update production 2026-09-17
elastic Azure RBAC Built-In Administrator Roles Assigned production 2026-09-17
elastic Potential RMM Execution from a Commonly Abused Web Service production 2026-09-16
elastic First Seen External MQTT Broker Connection production 2026-09-16
sigma HackTool - Dumpert Process Dumper Execution test 2026-09-16
splunk Windows Node.exe Executing JS Script In Immediate Folder production 2026-09-16
splunk Windows Process Accessing IronLanguages Repository On GitHub production 2026-09-16
splunk Windows For Loop Usage Within Cmd.exe To Execute Commands production 2026-09-16
splunk Windows Finger.exe Connecting to a Remote Host production 2026-09-16
snort ET INFO HTTP Permissions-Policy Geolocation Directive Misconfiguration rev 2 2026-09-16
suricata ET HUNTING HTTP Permissions-Policy Geolocation Directive Misconfiguration rev 2 2026-09-16
snort ET CURRENT_EVENTS Observed DNS Query to TA461 Domain rev 2 2026-09-15
snort ET CURRENT_EVENTS Observed DNS Query to TA461 Domain rev 1 2026-09-15
suricata ET PHISHING Observed DNS Query to TA461 Domain rev 1 2026-09-15
suricata ET PHISHING Observed TA461 Domain in TLS SNI rev 2 2026-09-15
suricata ET PHISHING Observed DNS Query to TA461 Domain rev 2 2026-09-15
elastic Linux Firewall Rule Creation or Modification production 2026-09-15
elastic Newly Seen Commonly Abused Network Scanner production 2026-09-15
sigma LSASS Access From Program In Potentially Suspicious Folder test 2026-09-15
sigma Elevated System Shell Spawned test 2026-09-15
sigma Potential Shellcode Injection test 2026-09-15
sigma Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock test 2026-09-14
sigma Suspicious Kerberos Ticket Request via CLI experimental 2026-09-14
elastic AWS Control Plane Access by Suspicious Process production 2026-09-14
elastic Unusual Process Resolving AWS ECS Agent Communication Service Endpoint production 2026-09-14
elastic AWS SSM Agent Registered via Hybrid Activation production 2026-09-14
elastic Potential Third-Party Cloud Storage Client Execution production 2026-09-14
elastic Potential Destructive AWS CLI Command Executed by GenAI Agent production 2026-09-14
elastic AWS Audit or Security Service Tampering via CLI production 2026-09-14
sigma Suspicious Login Activity Classified By Google experimental 2026-09-14
snort ET CURRENT_EVENTS ODx Exfil Activity M2 rev 2 2026-09-14
snort ET CURRENT_EVENTS ODx Exfil Activity M4 rev 2 2026-09-14
snort ET CURRENT_EVENTS ODx Exfil Activity M3 rev 2 2026-09-14
suricata ET PHISHING ODx Exfil Activity M3 rev 2 2026-09-14
suricata ET PHISHING ODx Exfil Activity M4 rev 2 2026-09-14
suricata ET PHISHING ODx Exfil Activity M2 rev 2 2026-09-14
snort ET TROJAN GemStone Gemini Chrome Extension CnC - Poll Commands rev 1 2026-09-11
snort ET TROJAN GemStone Gemini Chrome Extension CnC - Command Results rev 1 2026-09-11