Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CURRENT_EVENTS Microsoft Account Phishing Landing M1 2018-04-19 rev 2 2018-04-20
snort ET INFO Cisco Smart Install Protocol Observed rev 1 2018-04-20
snort ET EXPLOIT Cisco Smart Install Exploitation Tool - ChangeConfig rev 1 2018-04-20
snort ET CURRENT_EVENTS Centurylink Phishing Landing 2018-04-19 rev 2 2018-04-20
snort ET CURRENT_EVENTS Comcast/Xfinity Phishing Landing 2018-04-19 rev 2 2018-04-20
snort ET CURRENT_EVENTS Dropbox 000webhost Phishing Landing 2018-04-19 rev 2 2018-04-19
snort ET CURRENT_EVENTS Java Download non Jar file rev 5 2018-04-19
snort ET CURRENT_EVENTS Bank of America Phishing Landing 2018-04-19 rev 2 2018-04-19
snort ET CURRENT_EVENTS PDF Cloud Phishing Landing 2018-04-19 rev 2 2018-04-19
snort ET CURRENT_EVENTS Mail Verification Phishing Landing 2018-04-18 rev 2 2018-04-18
snort ET SCAN PHP Attack Tool Morfeus F Scanner rev 13 2018-04-17
snort ET CURRENT_EVENTS Successful Facebook Phish 2018-04-16 rev 2 2018-04-16
snort ET TROJAN IcedID/Emotet Certificate Observed M1 rev 3 2018-04-16
snort ET CURRENT_EVENTS Successful Halkbank Phish M2 2018-04-16 rev 2 2018-04-16
snort ET POLICY Internal Host Retrieving External IP via myip.dnsomatic.com rev 3 2018-04-16
snort ET CURRENT_EVENTS Successful Halkbank Phish M1 2018-04-16 rev 2 2018-04-16
snort ET CURRENT_EVENTS Successful DenizBank Phish 2018-04-16 rev 2 2018-04-16
snort ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 rev 2 2018-04-13
snort ET TROJAN LokiBot Keylogger Data Exfiltration Detected M2 rev 2 2018-04-13
snort ET TROJAN Iron/Maktub Locker Ransomware CnC Checkin rev 2 2018-04-12
snort ET TROJAN Pontoeb CnC rev 2 2018-04-11
snort ET TROJAN QRat.Java.RAT Post-Checkin Request rev 2 2018-04-10
snort ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-04-09 rev 2 2018-04-09
snort ET CURRENT_EVENTS DHL Phishing Landing 2018-04-09 rev 2 2018-04-09
snort ET CURRENT_EVENTS Paypal Phishing Landing 2018-04-09 rev 2 2018-04-09
snort ET MALWARE APN/Ask Toolbar PUA/PUP User-Agent rev 3 2018-04-09
snort ET CURRENT_EVENTS Facebook Phishing Landing 2018-04-09 rev 2 2018-04-09
snort ET CURRENT_EVENTS OneDrive Phishing Landing 2018-04-09 rev 2 2018-04-09
snort ET CURRENT_EVENTS Post.ch Cloned Phishing Landing 2018-04-09 rev 2 2018-04-09
snort ET CURRENT_EVENTS Apple Phishing Landing 2018-04-09 rev 2 2018-04-09
snort ET TROJAN Win32/DanijBot CnC Checkin rev 2 2018-04-06
snort ET TROJAN Win32/DanijBot CnC Task Status rev 2 2018-04-06
snort ET TROJAN OSX/OceanLotus.D Requesting Commands from CnC rev 2 2018-04-05
snort ET CURRENT_EVENTS Successful Paypal Phish 2015-12-08 M3 rev 3 2018-04-04
snort ET SCAN NYU Internet Census UA Inbound rev 1 2018-04-03
snort ET CURRENT_EVENTS Amazon Phish Landing Jun 22 2017 rev 5 2018-04-03
snort ET CURRENT_EVENTS Chase Phishing Landing 2018-03-28 rev 2 2018-03-28
snort ET CURRENT_EVENTS Impots Phishing Landing 2018-03-28 rev 2 2018-03-28
snort ET TROJAN Cridex Post to CnC rev 6 2018-03-28
snort ET SCAN Suspicious inbound to PostgreSQL port 5432 rev 3 2018-03-27