Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CURRENT_EVENTS Possible AMSI Powershell Bypass Attempt B641 rev 1 2017-08-11
snort ET CURRENT_EVENTS Possible AMSI Powershell Bypass Attempt B643 rev 1 2017-08-11
snort ET CURRENT_EVENTS Possible AMSI Powershell Bypass Attempt rev 1 2017-08-11
snort ET CURRENT_EVENTS Possible Veil Powershell Encoder B641 rev 1 2017-08-11
snort ET TROJAN [PTsecurity] Gozi/Ursnif Payload v12 rev 1 2017-08-11
snort ET CURRENT_EVENTS Possible Successful Phish - Verify Email Error Message M1 Aug 14 2017 rev 2 2017-08-11
snort ET CURRENT_EVENTS Successful Blockchain Account Phish Aug 19 2016 rev 3 2017-08-10
snort ET WEB_CLIENT HTA File containing Wscript.Shell Call - Potential CVE-2017-0199 rev 2 2017-08-07
snort ET CURRENT_EVENTS Magnitude EK Landing M1 Aug 05 2017 rev 1 2017-08-07
snort ET CURRENT_EVENTS Possible Successful Outlook Web App Phish 2016-12-28 rev 2 2017-08-03
snort ET CURRENT_EVENTS Successful Generic Phish - Fake Loading Page 2017-08-03 rev 1 2017-08-03
snort ET CURRENT_EVENTS RIG encrypted payload M1 Aug 01 2017 rev 2 2017-08-01
snort ET CURRENT_EVENTS RIG encrypted payload M1 Feb 02 2016 rev 2 2017-08-01
snort ET INFO Phishery Phishing Tool - Default SSL Certificate Observed rev 2 2017-07-28
snort ET TROJAN Revcode RAT CnC rev 1 2017-07-27
snort ET TROJAN Revcode RAT CnC 2 rev 1 2017-07-27
snort ET CURRENT_EVENTS Successful Apple Phish M2 2015-12-02 rev 2 2017-07-21
snort ET CURRENT_EVENTS Successful Apple Phish M3 2016-09-29 rev 2 2017-07-21
snort ET CURRENT_EVENTS Successful Apple Phish 2016-10-05 rev 3 2017-07-21
snort ET CURRENT_EVENTS Successful AOL Phish M1 2016-07-14 rev 2 2017-07-21
snort ET CURRENT_EVENTS Successful Anonisma Paypal Phish 2015-12-29 rev 2 2017-07-21
snort ET CURRENT_EVENTS Successful Apple Phish M1 2015-12-02 rev 3 2017-07-21
snort ET CURRENT_EVENTS Successful AOL Phish M3 2016-07-14 rev 2 2017-07-21
snort ET CURRENT_EVENTS Successful AOL Phish M1 2016-07-14 rev 2 2017-07-21
snort ET CURRENT_EVENTS Successful Paypal Phish M1 Dec 8 2015 rev 4 2017-07-21
snort ET CURRENT_EVENTS Successful Apple ID Phish M1 2016-10-04 rev 3 2017-07-21
snort ET CURRENT_EVENTS Successful Amazon Account Phish 2015-08-21 rev 2 2017-07-20
snort ET CURRENT_EVENTS Successful Amazon Phish M2 2016-10-05 rev 2 2017-07-20
snort ET CURRENT_EVENTS Successful Ameli.fr Phish M1 2016-10-26 rev 2 2017-07-20
snort ET TROJAN DarkHotel Downloader CnC Beacon 1 rev 1 2017-07-20
snort ET CURRENT_EVENTS Successful Amazon Account Phish 2015-08-21 rev 2 2017-07-20
snort ET CURRENT_EVENTS Successful Ameli.fr Phish M2 Oct 26 2016-10-26 rev 2 2017-07-20
snort ET TROJAN DarkHotel Downloader CnC Beacon 2 rev 1 2017-07-20
snort ET CURRENT_EVENTS Successful Amazon Phish 2015-11-07 rev 3 2017-07-20
snort ET CURRENT_EVENTS Successful PHOEN!X Apple Phish M2 2015-12-29 rev 2 2017-07-19
snort ET TFTP Outbound TFTP Data Transfer with Cisco config rev 5 2017-07-19
snort ET TFTP Outbound TFTP Data Transfer With Cisco Config 2 rev 2 2017-07-19
snort ET TROJAN Win32/Ramnit Checkin rev 5 2017-07-19
snort ET WEB_CLIENT Tech Support Scam Landing Jul 19 2017 rev 2 2017-07-18
snort ET CURRENT_EVENTS Successful Alibaba Phish 2016-10-18 rev 2 2017-07-17