Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE DonotGroup CnC Domain Observed in DNS Query rev 2 2020-09-02
suricata ET ADWARE_PUP Win32/Xetapp Installer Checkin rev 2 2020-09-02
suricata ET MALWARE Possible DeadlyKiss APT CnC Domain Observed in DNS Query rev 2 2020-09-02
suricata ET INFO Metacafe.com Social Site Access rev 7 2020-09-02
suricata ET MALWARE Lemon_Duck Linux Shell Script CnC Activity rev 2 2020-09-02
suricata ET MALWARE Theoreon.com Related Trojan Checkin rev 5 2020-09-02
suricata ET WEB_SPECIFIC_APPS iScripts MultiCart orderid Parameter UPDATE SET SQL Injection Attempt rev 5 2020-09-02
suricata ET INFO Smilebox Spyware Download rev 11 2020-09-02
suricata ET MALWARE Win32.Small.AB or related Post-infection checkin rev 5 2020-09-02
suricata ET INFO Myspace Login Attempt rev 8 2020-09-02
suricata ET INFO Orkut.com Social Site Access rev 6 2020-09-02
suricata ET WEB_SPECIFIC_APPS w-Agora SQL Injection Attempt -- search.php search_user UNION SELECT rev 8 2020-09-02
suricata ET WEB_SPECIFIC_APPS iScripts MultiCart orderid Parameter INSERT INTO SQL Injection Attempt rev 5 2020-09-02
suricata ET MALWARE PLATINUM Dipsind CnC Beacon rev 3 2020-09-02
suricata ET INFO NBC Streaming Video rev 7 2020-09-02
suricata ET WEB_SPECIFIC_APPS w-Agora SQL Injection Attempt -- search.php search_forum UPDATE rev 8 2020-09-02
suricata ET MALWARE Zlob Updating via HTTP rev 7 2020-09-02
suricata ET MALWARE Zyklon CnC Activity rev 1 2020-09-02
snort ET MALWARE Win32/Zonebac Traffic Redirect rev 2 2020-09-01
snort ET CURRENT_EVENTS 16Shop Phishing Kit Accessed on External Compromised Server rev 3 2020-09-01
snort ET WEB_SERVER 16Shop Phishing Kit Accessed on Internal Compromised Server rev 3 2020-09-01
suricata ET WEB_CLIENT Microsoft Tech Support Phone Scam M2 Jul 07 2017 rev 4 2020-09-01
suricata ET EXPLOIT Secutech Router DNS Changer Exploit Attempt rev 2 2020-09-01
suricata ET WEB_CLIENT Apple Tech Support Phone Scam Jul 07 2017 rev 4 2020-09-01
suricata ET WEB_CLIENT DRIVEBY FakeUpdate - URI - /styles/javaupdate.css rev 4 2020-09-01
suricata ET WEB_CLIENT Fake AV Phone Scam Landing June 11 2015 M1 rev 5 2020-09-01
suricata ET MALWARE Aurora Ransomware CnC Checkin rev 4 2020-09-01
suricata ET EXPLOIT Joomla 3.2.1 SQL injection attempt rev 4 2020-09-01
suricata ET WEB_CLIENT Fake AV Phone Scam Domain M3 Mar 3 rev 5 2020-09-01
suricata ET PHISHING DNS Query to Generic 107 Phishing Domain rev 4 2020-09-01
suricata ET WEB_CLIENT Fake AV Phone Scam Landing June 26 2015 M5 rev 4 2020-09-01
suricata ET P2P Tor Get Server Request rev 5 2020-09-01
suricata ET WEB_CLIENT Fake AV Phone Scam Domain M1 Mar 3 rev 5 2020-09-01
suricata ET WEB_SERVER WebShell Generic - *.tar.gz in POST body rev 4 2020-09-01
suricata ET WEB_CLIENT Microsoft Tech Support Phone Scam M1 Jul 07 2017 rev 4 2020-09-01
suricata ET WEB_CLIENT Fake Windows Security Warning - png rev 4 2020-09-01
suricata ET INFO McAfee AV Download - Set rev 2 2020-09-01
suricata ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-ajax.php cookie SELECT rev 9 2020-09-01
suricata ET WEB_CLIENT Microsoft Tech Support Phone Scam M4 Jul 07 2017 rev 4 2020-09-01
suricata ET WEB_CLIENT DRIVEBY FakeSupport - URI - windows-firewall.png rev 4 2020-09-01