Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Lemon_Duck Powershell - RDP Credential Exfil rev 2 2019-11-20
suricata ET MALWARE Lemon_Duck Powershell - RDP Credential Exfil rev 1 2019-11-20
snort ET CURRENT_EVENTS Possible Pipka JS Skimmer - Skimmer Payload Observed M1 rev 2 2019-11-18
snort ET CURRENT_EVENTS Possible Pipka JS Skimmer - Skimmer Payload Observed M4 rev 2 2019-11-18
snort ET CURRENT_EVENTS Possible Pipka JS Skimmer - Skimmer Payload Observed M7 rev 2 2019-11-18
snort ET CURRENT_EVENTS Possible Pipka JS Skimmer - Skimmer Payload Observed M6 rev 2 2019-11-18
snort ET CURRENT_EVENTS Possible Pipka JS Skimmer - Skimmer Payload Observed M3 rev 2 2019-11-18
snort ET CURRENT_EVENTS Possible Pipka JS Skimmer CnC Request rev 2 2019-11-18
snort ET TROJAN Win32/Agent Tesla SMTP Clipboard Exfil rev 2 2019-11-18
snort ET CURRENT_EVENTS Possible Pipka JS Skimmer - Skimmer Payload Observed M2 rev 2 2019-11-18
snort ET CURRENT_EVENTS Possible Pipka JS Skimmer - Skimmer Payload Observed M5 rev 2 2019-11-18
suricata ET MALWARE Win32/Agent Tesla SMTP Clipboard Exfil rev 1 2019-11-18
snort ET CURRENT_EVENTS Spelevo VBS Payload Downloaded rev 3 2019-11-15
snort ET TROJAN Observed CobInt CnC Domain in TLS SNI rev 2 2019-11-15
snort ET TROJAN Observed CobInt CnC Domain in TLS SNI rev 2 2019-11-15
snort ET CURRENT_EVENTS Possible PurpleFox EK Framework Flash HEAD Request rev 2 2019-11-14
snort ET CURRENT_EVENTS Possible PurpleFox EK Framework Flash GET Request rev 2 2019-11-14
snort ET WEB_CLIENT Tech Support Scam 2019-11-14 rev 2 2019-11-14
snort ET TROJAN Win32/CopperStealer CnC Activity rev 2 2019-11-14
snort ET WEB_CLIENT Tech Support Scam 2019-11-14 rev 2 2019-11-14
snort ET TROJAN Win32/AnteFrigus Ransomware Activity rev 2 2019-11-13
snort ET TROJAN Gamaredon CnC Domain Observed in DNS Query rev 2 2019-11-13
snort ET TROJAN Bandook v1.35 Initial Connection and Report rev 6 2019-11-13
snort ET TROJAN MSIL/Almashreq CnC Checkin rev 3 2019-11-11
snort ET TROJAN Platinum APT Activity rev 2 2019-11-11
snort ET TROJAN Platinum APT - Titanium Hardcoded String Observed rev 2 2019-11-11
snort ET TROJAN Gamaredon CnC Domain Observed in DNS Query rev 2 2019-11-11
snort ET TROJAN Gamaredon CnC Domain Observed in DNS Query rev 2 2019-11-11
suricata ET MALWARE Platinum APT - Titanium Hardcoded String Observed rev 1 2019-11-11
snort ET TROJAN Observed AHK Downloader Request Structure rev 2 2019-11-08
snort ET TROJAN Win32/IcedID WebSocket Request M2 rev 2 2019-11-08
snort ET TROJAN Keyboy CN APT CnC Domain in DNS Lookup rev 2 2019-11-07
snort ET TROJAN Keyboy CN APT CnC Domain in DNS Lookup rev 2 2019-11-07
snort ET TROJAN Keyboy CN APT CnC Domain in DNS Lookup rev 2 2019-11-07
snort ET TROJAN Keyboy CN APT CnC Domain in DNS Lookup rev 2 2019-11-07
snort ET TROJAN Keyboy CN APT CnC Domain in DNS Lookup rev 2 2019-11-07
snort ET TROJAN Keyboy CN APT CnC Domain in DNS Lookup rev 2 2019-11-07
snort ET TROJAN Keyboy CN APT CnC Domain in DNS Lookup rev 2 2019-11-07
snort ET CURRENT_EVENTS Successful Microsoft Account Phish 2019-11-06 rev 2 2019-11-06
snort ET CURRENT_EVENTS Capesand EK Landing rev 2 2019-11-05