Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET INFO Hola VPN Activity - X-Hola-* Headers rev 4 2024-04-28
suricata ET EXPLOIT Eir D1000 Modem CWMP Exploit Retrieving Wifi Key rev 7 2024-04-28
suricata ET MALWARE Cobalt Strike Malleable C2 Webbug Profile rev 7 2024-04-28
suricata ET PHISHING Google Drive Phishing Landing 2015-11-17 rev 5 2024-04-28
suricata ET MALWARE Win32/Travnet.A Checkin rev 9 2024-04-28
suricata ET MALWARE vSkimmer.PoS Checkin rev 8 2024-04-28
suricata ET MALWARE Sisproc update rev 8 2024-04-28
suricata ET MALWARE MalDoc Retrieving Payload March 30 2017 rev 6 2024-04-28
suricata ET WEB_CLIENT Tech Support Phone Scam Landing M1 Oct 16 2016 rev 7 2024-04-28
suricata ET MALWARE PunkeyPOS HTTP CnC Beacon Fake UA rev 6 2024-04-28
suricata ET MALWARE Gamarue/Andromeda Downloading Payload rev 5 2024-04-28
suricata ET MALWARE Quant Loader Download Request rev 7 2024-04-28
suricata ET MALWARE Bookworm CnC Beacon rev 6 2024-04-28
suricata ET ADWARE_PUP PUP.GigaClicks Checkin rev 6 2024-04-28
suricata ET MALWARE W32/Dridex Binary Download Mar 23 2016 rev 7 2024-04-28
suricata ET ADWARE_PUP Win32/Atshz.A Checkin rev 7 2024-04-28
suricata ET MALWARE JS/HTA Downloader Behavior M3 rev 8 2024-04-28
suricata ET WEB_SERVER LEMURLOOT WebShell Interaction Header - X-siLock-Step2/3 File Retrieval Request- Observed in MOVEit File Transfer - INBOUND rev 2 2024-04-27
suricata ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request rev 2 2024-04-27
suricata ET MOBILE_MALWARE Android/InfamousChisel.InfoStealer APT28/SANDWORM Data Exfiltration rev 2 2024-04-27
suricata ET HUNTING Suspected Gamaredon Template Retrieval rev 2 2024-04-27
suricata ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - Guest Account Creation - CVE-2023-34362 Stage 1a rev 2 2024-04-27
suricata ET MALWARE Win32/Gomorrah Stealer Data Exfiltration rev 5 2024-04-27
suricata ET INFO Lucy Security - Awareness Landing Page M1 rev 7 2024-04-27
suricata ET HUNTING WebDAV Retrieving .exe rev 2 2024-04-27
suricata ET INFO Lucy Security - Server Reply rev 6 2024-04-27
suricata ET MALWARE Brosql Stealer Browser Cookie Exfil rev 2 2024-04-27
suricata ET MALWARE Win32/TA402 Checkin M2 rev 2 2024-04-27
suricata ET MALWARE Suspected TA451 Related FalseFont Backdoor Activity M5 rev 4 2024-04-27
suricata ET MALWARE Win32/RustMiner Suspicious HTTP Accept Header Observed rev 2 2024-04-27
suricata ET HUNTING WebDAV Retrieving .dll rev 2 2024-04-27
suricata ET WEB_SPECIFIC_APPS MOVEit File Transfer - Payload Trigger Request - CVE-2023-34362 Stage 5b rev 2 2024-04-27
suricata ET MALWARE Kaiten User Agent rev 2 2024-04-27
suricata ET MALWARE Suspected Turla APT Kazuar Backdoor Related Activity rev 2 2024-04-27
suricata ET MALWARE Win32/Comotor.A!dll Reporting 1 rev 9 2024-04-27
suricata ET MALWARE OrbitalBeam CnC Token Request rev 2 2024-04-27
suricata ET MALWARE [ANY.RUN] Konni.APT Keep-Alive rev 2 2024-04-27
suricata ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - SQLi Payload Creation - CVE-2023-34362 Stage 5a rev 2 2024-04-27
suricata ET MALWARE CMDEmber Backdoor Style Request rev 2 2024-04-27
suricata ET HUNTING WebDAV Retrieving .zip containing .exe rev 2 2024-04-27