Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CURRENT_EVENTS L33bo Phishing Landing 2016-03-29 rev 3 2017-12-29
snort ET CURRENT_EVENTS Successful HitBTC Cryptocurrency Exchange Phish 2017-12-28 rev 2 2017-12-28
snort ET CURRENT_EVENTS Successful Yobit Cryptocurrency Exchange Phish 2017-12-28 rev 2 2017-12-28
snort ET CURRENT_EVENTS Successful Liqui Cryptocurrency Exchange Phish 2017-12-28 rev 2 2017-12-28
snort ET CURRENT_EVENTS Paypal Phishing Landing 2017-12-26 rev 2 2017-12-26
snort ET TROJAN Smurf2 CnC Checkin rev 2 2017-12-21
snort ET TROJAN Windows Executable Sent When Remote Host Claims to Send a RAR Archive rev 2 2017-12-21
snort ET TROJAN WooSIP Downloader CnC CreateFolderOnServer rev 2 2017-12-21
snort ET TROJAN WooSIP Downloader CnC WriteMetadataOnServer rev 2 2017-12-21
snort ET TROJAN Windows Executable Downloaded With Image Content-Type Header rev 2 2017-12-21
snort ET TROJAN WooSIP Downloader CnC DeleteFileOnServer rev 2 2017-12-21
snort ET CURRENT_EVENTS Successful Paypal Phish Oct 16 2017 rev 2 2017-12-20
snort ET TROJAN Win32/Backdoor.YesMaster CnC Checkin rev 2 2017-12-20
snort ET CURRENT_EVENTS Possible Fedex Phishing Landing - Title over non SSL rev 2 2017-12-20
snort ET CURRENT_EVENTS Qtloader encrypted check-in Oct 19 M1 rev 3 2017-12-18
snort ET TROJAN Win32/Bot.Sezin CnC Checkin rev 2 2017-12-13
snort ET CURRENT_EVENTS Successful Excel Online Phish 2015-12-08 rev 5 2017-12-12
snort ET TROJAN Win32/Backdoor.Randrew.A CnC Checkin rev 2 2017-12-11
snort ET TROJAN GratefulPOS Covert DNS CnC Initial Checkin rev 2 2017-12-11
snort ET CURRENT_EVENTS Mailbox Shutdown Phishing Landing 2017-12-11 rev 2 2017-12-11
snort ET CHAT GaduGadu Chat Server Welcome Packet rev 5 2017-12-11
snort ET CURRENT_EVENTS Successful Gmail Phish M1 2016-10-12 rev 3 2017-12-11
snort ET INFO HTTP POST Request to Suspicious *.ml Domain rev 3 2017-12-07
snort ET INFO HTTP POST Request to Suspicious *.cf Domain rev 3 2017-12-07
snort ET POLICY possible OnePlus phone data leakage DNS rev 2 2017-12-07
snort ET POLICY OnePlus phone data leakage rev 3 2017-12-07
snort ET CURRENT_EVENTS Successful Banco de la Nacion Phish 2016-10-18 rev 2 2017-12-06
snort ET CURRENT_EVENTS Possible MyEtherWallet Phishing Landing - Title over non SSL rev 2 2017-12-06
snort ET EXPLOIT SolusVM 1.13.03 SQL injection rev 3 2017-12-05
snort ET TROJAN Observed SluttyPutty Maldoc User-Agent rev 2 2017-12-05
snort ET POLICY localtunnel Connection Setup Attempt rev 2 2017-12-04
snort ET POLICY localtunnel Sucessful Connection Setup rev 2 2017-12-04
snort ET CURRENT_EVENTS Successful EDU Phish 2017-12-04 rev 2 2017-12-04
snort ET INFO HTTP POST Request to Suspicious *.ga Domain rev 2 2017-12-03
snort ET INFO HTTP POST Request to Suspicious *.gq domain rev 2 2017-12-03
snort ET INFO HTTP POST Request to Suspicious *.gdn Domain rev 2 2017-12-03
snort ET TROJAN UBoatRAT CnC Check-in rev 1 2017-12-01
snort ET CURRENT_EVENTS Successful BankAustria Phish Nov 03 2017 rev 3 2017-12-01
snort ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt rev 3 2017-11-30
snort ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt rev 4 2017-11-30