Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET INFO Lucy Security - Awareness Landing Page M1 rev 7 2024-04-27
suricata ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - Guest Account Creation - CVE-2023-34362 Stage 1a rev 2 2024-04-27
suricata ET WEB_CLIENT WebDAV GET Request for .url Flowbit Set rev 2 2024-04-27
suricata ET INFO External Host Sending Docker Swarm Join Command rev 4 2024-04-27
suricata ET MALWARE [ANY.RUN] Konni.APT Keep-Alive rev 2 2024-04-27
suricata ET HUNTING WebDAV Retrieving .dll rev 2 2024-04-27
suricata ET HUNTING WebDAV Retrieving .zip containing .exe rev 2 2024-04-27
suricata ET MALWARE Win32/TA402 Checkin M2 rev 2 2024-04-27
suricata ET MALWARE Suspected TA451 Related FalseFont Backdoor Activity M5 rev 4 2024-04-27
suricata ET MALWARE Win32.Crypt.nc Checkin rev 9 2024-04-27
suricata ET MALWARE Brosql Stealer Browser Login Exfil rev 2 2024-04-27
suricata ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request rev 2 2024-04-27
suricata ET MALWARE CMDEmber Backdoor Style Request rev 2 2024-04-27
suricata ET MALWARE Win32/Comotor.A!dll Reporting 1 rev 9 2024-04-27
suricata ET MALWARE Suspected Turla APT Kazuar Backdoor Related Activity rev 2 2024-04-27
suricata ET MALWARE OrbitalBeam CnC Token Request rev 2 2024-04-27
suricata ET WEB_SPECIFIC_APPS MOVEit File Transfer - Payload Trigger Request - CVE-2023-34362 Stage 5b rev 2 2024-04-27
suricata ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - SQLi Payload Creation - CVE-2023-34362 Stage 5a rev 2 2024-04-27
suricata ET MALWARE Win32/RustMiner Suspicious HTTP Accept Header Observed rev 2 2024-04-27
suricata ET MOBILE_MALWARE Android/InfamousChisel.InfoStealer APT28/SANDWORM Data Exfiltration rev 2 2024-04-27
suricata ET MALWARE Win32/Gomorrah Stealer Data Exfiltration rev 5 2024-04-27
suricata ET MALWARE Observed Sharp Panda APT Related Activity M2 rev 2 2024-04-27
suricata ET HUNTING Possible cs2nginx Proxy Redirect rev 5 2024-04-27
suricata ET HUNTING Abnormal User-Agent No space after colon - Likely Hostile rev 15 2024-04-27
suricata ET MALWARE Backdoor.Win32.Sykipot Checkin rev 6 2024-04-27
snort ET INFO Gophish X-Server rev 3 2024-04-26
snort ET CURRENT_EVENTS Parrot TDS NDSW Check M2 rev 1 2024-04-26
suricata ET MOBILE_MALWARE Trojan-Ransom.AndroidOS.CryCrypt.c Checkin rev 2 2024-04-26
suricata ET MALWARE ReverseRat 3.0 CnC Checkin M2 rev 2 2024-04-26
suricata ET MALWARE DeltaStealer Exfiltrating Data to gofile .io rev 2 2024-04-26
suricata ET HUNTING Possible Snake Header in HTTP Request rev 2 2024-04-26
suricata ET MALWARE Win32/Wacapew.C!ml Checkin rev 2 2024-04-26
suricata ET MALWARE Win32/RM3Loader Server Response rev 2 2024-04-26
suricata ET MALWARE EICAR File Sent With X-Powered By Kaspersky Labs 2022-11-03 rev 2 2024-04-26
suricata ET MALWARE IIS Backdoor CnC Command Inbound rev 2 2024-04-26
suricata ET MALWARE Win64/Agent.BP Checkin rev 2 2024-04-26
suricata ET ADWARE_PUP Win32/Adware.Neoreklami.MI Activity M1 rev 2 2024-04-26
suricata ET HUNTING Observed Nighthawk 404 Server Response rev 2 2024-04-26
suricata ET MALWARE Suspected Gamaredon Related Maldoc Activity M2 rev 2 2024-04-26
suricata ET GAMES Multiple Game Cheat Application Related Activity rev 2 2024-04-26