Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN GemStone Gemini Chrome Extension CnC - Register rev 1 2026-09-11
snort ET TROJAN GemStone Gemini Chrome Extension CnC - Command Results rev 1 2026-09-11
snort ET TROJAN GemStone Gemini Chrome Extension CnC - Poll Commands rev 1 2026-09-11
snort ET TROJAN GemStone Gemini Chrome Extension CnC - Heartbeat rev 1 2026-09-11
snort ET TROJAN GemStone Gemini Chrome Extension CnC - Ingest rev 1 2026-09-11
suricata ET MALWARE GemStone Gemini Chrome Extension CnC - Register rev 1 2026-09-11
suricata ET MALWARE GemStone Gemini Chrome Extension CnC - Poll Commands rev 1 2026-09-11
suricata ET MALWARE GemStone Gemini Chrome Extension CnC - Command Results rev 1 2026-09-11
suricata ET MALWARE GemStone Gemini Chrome Extension CnC - Heartbeat rev 1 2026-09-11
suricata ET MALWARE GemStone Gemini Chrome Extension CnC - Ingest rev 1 2026-09-11
suricata ET MALWARE GemStone Gemini Chrome Extension CnC - Screenshots rev 1 2026-09-11
suricata ET HUNTING GET to ip .ipify .org via WinHTTP rev 1 2026-09-11
snort ET CURRENT_EVENTS Darksword iOS EK RCE Worker Page rev 1 2026-09-10
snort ET CURRENT_EVENTS Darksword iOS EK Landing Page rev 1 2026-09-10
snort ET CURRENT_EVENTS Darksword iOS EK RCE Loader Page rev 1 2026-09-10
snort ET RETIRED Foxit PDF Reader Title Stack Overflow rev 5 2026-09-10
suricata ET EXPLOIT_KIT Darksword iOS EK RCE Worker Page rev 1 2026-09-10
suricata ET EXPLOIT_KIT Darksword iOS EK Landing Page rev 1 2026-09-10
suricata ET RETIRED Foxit PDF Reader Title Stack Overflow rev 6 2026-09-10
suricata ET EXPLOIT_KIT Darksword iOS EK RCE Loader Page rev 1 2026-09-10
splunk XMRIG Driver Loaded deprecated 2026-09-08
splunk ESXi Bulk VM Termination production 2026-09-08
splunk Windows Process Injection into Commonly Abused Processes production 2026-09-08
splunk Windows Possible Credential Dumping production 2026-09-08
splunk Windows Handle Duplication in Known UAC-Bypass Binaries production 2026-09-08
splunk Windows Access Token Winlogon Duplicate Handle In Uncommon Path production 2026-09-08
splunk Windows Access Token Manipulation Winlogon Duplicate Token Handle production 2026-09-08
splunk Rubeus Kerberos Ticket Exports Through Winlogon Access production 2026-09-08
splunk Detect Credential Dumping through LSASS access production 2026-09-08
splunk ESXi Audit Tampering production 2026-09-08
splunk Email files written outside of the Outlook directory production 2026-09-08
splunk Cisco IOS XE WebUI Programmatic Configuration production 2026-09-08
splunk Windows Unusual File Creation in Confluence Directory production 2026-09-08
splunk Unusually Long Content-Type Length experimental 2026-09-08
splunk Plain HTTP POST Exfiltrated Data production 2026-09-08
splunk Nginx ConnectWise ScreenConnect Authentication Bypass production 2026-09-08
splunk Log4Shell JNDI Payload Injection with Outbound Connection production 2026-09-08
splunk Log4Shell JNDI Payload Injection Attempt production 2026-09-08
splunk CrushFTP Max Simultaneous Users From IP production 2026-09-08
splunk CrushFTP Authentication Bypass Exploitation production 2026-09-08