Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CURRENT_EVENTS KaiXin Landing Page Nov 25 2014 rev 1 2014-11-26
snort ET TROJAN W32/DoubleTap.APT Downloader Socks5 Setup Request rev 2 2014-11-26
snort ET TROJAN Possible Regin Init CnC Beacon TCP rev 2 2014-11-26
snort ET MOBILE_MALWARE Android.Stealthgenie Checkin rev 1 2014-11-25
snort ET TROJAN CoinVault POST M2 rev 1 2014-11-24
snort ET TROJAN W32/AntiBreach Possible Activation Attempt rev 1 2014-11-21
snort ET TROJAN Rerdom/Asprox CnC Beacon rev 1 2014-11-20
snort ET WEB_SERVER FOX-SRT - Backdoor - CryptoPHP Shell C2 POST rev 1 2014-11-20
snort ET TROJAN Sefnit Checkin rev 3 2014-11-19
snort ET TROJAN ELF_BASHLITE.SMB Dropping Files rev 1 2014-11-19
snort ET TROJAN OSX/WireLurker HTTP Request for manhuaba.com.cn rev 2 2014-11-18
snort ET TROJAN DEEP PANDA Checkin 3 rev 4 2014-11-18
snort ET WEB_SERVER Possible CVE-2014-3120 Elastic Search Remote Code Execution Attempt rev 2 2014-11-17
snort ET TROJAN Windows executable base64 encoded in XML rev 8 2014-11-15
snort ET WEB_CLIENT Possible Internet Explorer VBscript failure to handle error case information disclosure obfuscated CVE-2014-6332 rev 1 2014-11-15
snort ET TROJAN Possible Asprox Pizza rev 1 2014-11-15
snort ET TROJAN Possible Emotet DGA NXDOMAIN Responses rev 1 2014-11-12
snort ET TROJAN Emotet CnC Beacon rev 1 2014-11-12
snort ET TROJAN OSX/WireLurker CnC Beacon rev 2 2014-11-12
snort ET TROJAN Possible Rar'd Malware sent when remote host claims to send an Image rev 7 2014-11-12
snort ET TROJAN OSX/WireLurker CnC Beacon rev 2 2014-11-12
snort ET TROJAN Miuref/Boaxxe Checkin rev 5 2014-11-08
snort ET TROJAN OSX/WireLurker HTTP Request for www.comeinbaby.com rev 3 2014-11-07
snort ET CURRENT_EVENTS Nuclear SilverLight Exploit rev 1 2014-11-07
snort ET TROJAN OSX/WireLurker checkin rev 1 2014-11-07
snort GPL VOIP SIP 401 Unauthorized Flood rev 5 2014-11-06
snort ET TROJAN Variant.Strictor Dropper rev 5 2014-11-04
snort ET TROJAN Cohhoc RAT CnC Request rev 2 2014-11-04
snort ET CURRENT_EVENTS Fiesta SilverLight 5.x Exploit URI Struct rev 1 2014-11-03
snort ET POLICY Office Document Containing AutoExec Macro Via smtp rev 2 2014-10-31
snort ET CURRENT_EVENTS Fiesta Flash Exploit URI Struct rev 6 2014-10-31
snort ET POLICY Office Document Containing AutoOpen Macro Via smtp rev 2 2014-10-31
snort ET SMTP SUSPICIOUS SMTP Attachment Inbound PPT attachment with Embedded OLE Object M1 rev 2 2014-10-31
snort ET POLICY Office Document Containing AutoOpen Macro Via smtp rev 2 2014-10-31
snort ET POLICY Office Document Containing AutoExec Macro Via smtp rev 2 2014-10-31
snort ET POLICY Office Document Containing AutoExec Macro Via smtp rev 2 2014-10-31
snort ET POLICY Office Document Containing AutoOpen Macro Via smtp rev 2 2014-10-31
snort ET TROJAN Win32/Hikit Server Authentication Response rev 2 2014-10-31
snort ET POLICY Office Document Download Containing AutoExec Macro rev 1 2014-10-31
snort GPL VOIP EXPLOIT SIP UDP Softphone overflow attempt rev 2 2014-10-30