Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET VOIP H.323 in Q.931 Call Setup - Inbound rev 1 2015-11-03
snort ET CURRENT_EVENTS Successful NatWest Bank Phish 2015-11-03 rev 1 2015-11-03
snort ET VOIP Possible Misuse Call from MERA RTU rev 1 2015-11-03
snort ET CURRENT_EVENTS Successful Paypal Account Phish Oct 30 rev 2 2015-11-02
snort ET CURRENT_EVENTS Successful Paypal Account Phish 2015-10-30 2 rev 1 2015-11-02
snort ET CURRENT_EVENTS Successful Zimbra Phish 2015-10-30 rev 2 2015-11-02
snort ET CURRENT_EVENTS Successful Paypal Account Phish 2015-10-30 3 rev 1 2015-11-02
snort ET CURRENT_EVENTS Possible Malicious Redirect Leading to EK Oct 29 rev 2 2015-10-29
snort ET CURRENT_EVENTS Successful Paypal Phish 2015-10-28 3 rev 1 2015-10-28
snort ET CURRENT_EVENTS Successful Docusign Phish 2015-10-28 rev 1 2015-10-28
snort ET CURRENT_EVENTS Successful Paypal Phish 2015-10-29 rev 1 2015-10-28
snort ET CURRENT_EVENTS Successful Paypal Phish 2015-10-28 rev 1 2015-10-28
snort ET CURRENT_EVENTS Successful IBC Bank Phish 2015-10-29 rev 1 2015-10-28
snort ET TROJAN LuminosityLink - Data Channel Server Response rev 1 2015-10-26
snort ET TROJAN LuminosityLink - Data Channel Client Request rev 1 2015-10-26
snort ET CURRENT_EVENTS Successful Paypal Phish 2015-10-23 rev 1 2015-10-23
snort ET CURRENT_EVENTS Successful Paypal Phish 2015-10-23 rev 1 2015-10-23
snort ET CURRENT_EVENTS Successful Paypal Phish 2015-10-23 rev 1 2015-10-23
snort ET TROJAN Backdoor.Win32.DarkComet Screenshot Upload Successful rev 1 2015-10-23
snort ET CURRENT_EVENTS Successful Paypal Phish 2015-10-23 rev 1 2015-10-23
snort ET CURRENT_EVENTS Chase Account Phish Landing Oct 22 rev 1 2015-10-22
snort ET TROJAN NetWire Variant - Server Directory Listing Request rev 2 2015-10-22
snort ET CURRENT_EVENTS Yahoo Account Phish Landing 2015-10-23 rev 1 2015-10-22
snort ET CURRENT_EVENTS Successful Zimbra Account Phish 2015-10-23 rev 1 2015-10-22
snort ET TROJAN NetWire Variant - Client Hello rev 2 2015-10-22
snort ET WEB_CLIENT Fake Java Installer Landing Page Oct 21 rev 1 2015-10-21
snort ET CURRENT_EVENTS Possible click2play bypass Oct 19 2015 as observed in PawnStorm rev 3 2015-10-21
snort ET WEB_SPECIFIC_APPS Open Web Analytics owa_action Parameter Local File inclusion Attempt rev 3 2015-10-20
snort ET CURRENT_EVENTS Successful USAA Phish 2015-10-20 rev 1 2015-10-20
snort ET WEB_SPECIFIC_APPS Open Web Analytics owa_do Parameter Local File inclusion Attempt rev 3 2015-10-20
snort ET TROJAN Backdoor.Meciv Checkin rev 3 2015-10-20
snort GPL FTP USER overflow attempt rev 35 2015-10-19
snort ET WEB_SPECIFIC_APPS DBHcms editmenu Parameter UNION SELECT SQL Injection Attempt rev 3 2015-10-19
snort ET TROJAN Nemucod Downloading Payload 2 rev 2 2015-10-19
snort ET WEB_SPECIFIC_APPS DBHcms editmenu Parameter INSERT INTO SQL Injection Attempt rev 3 2015-10-19
snort ET CURRENT_EVENTS Successful Google Drive Phish 2015-09-22 rev 2 2015-10-19
snort ET WEB_SPECIFIC_APPS DBHcms editmenu Parameter DELETE FROM SQL Injection Attempt rev 3 2015-10-19
snort ET WEB_SPECIFIC_APPS DBHcms editmenu Parameter UPDATE SET SQL Injection Attempt rev 3 2015-10-19
snort ET CURRENT_EVENTS Successful Paypal Account Phish 2015-10-16 rev 1 2015-10-16
snort ET CURRENT_EVENTS Successful Paypal Account Phish 2015-10-16 rev 1 2015-10-16