Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Lazarus Related Maldoc Activity rev 2 2024-04-25
suricata ET INFO AmeriTechnology Group - CHARM Client rev 2 2024-04-25
suricata ET MALWARE Win32/Malgent!MSR Dropper Requesting Payload rev 2 2024-04-25
suricata ET MALWARE W32/Witch.3FA0!tr CnC Activity M3 rev 2 2024-04-25
suricata ET MALWARE Fake Software Download Redirect Leading to Malware M1 rev 2 2024-04-25
suricata ET PHISHING Phishery Phishing Tool - Default SSL Certificate Observed rev 3 2024-04-25
suricata ET ADWARE_PUP Win32/Systweak Checkin M2 rev 2 2024-04-25
suricata ET EXPLOIT Apache Ambari Default Credentials Attempt rev 2 2024-04-25
suricata ET MALWARE Suspected Malicious VBS Script Activity rev 2 2024-04-25
suricata ET MALWARE Win32/NitroStealer CnC Exfil M2 rev 2 2024-04-25
suricata ET MALWARE MSIL/Injector.VVP Downloader Activity M1 rev 3 2024-04-25
suricata ET MALWARE W32/Snojan.BNQKZQH CnC Activity rev 3 2024-04-25
suricata ET INFO Possible Autodiscover Credentials Leak via Basic Auth rev 2 2024-04-25
suricata ET EXPLOIT Linux/Attempted Hosts File Exfil rev 3 2024-04-25
suricata ET MALWARE APT Related CR4T Backdoor Activity rev 2 2024-04-25
suricata ET MALWARE TinyTurla CnC Activity rev 2 2024-04-25
suricata ET MALWARE ELF/Roboto - Possible Encrypted Roboto P2P Payload Requested M1 rev 4 2024-04-25
suricata ET MALWARE Win32/DCRat CnC Exfil rev 3 2024-04-25
suricata ET HUNTING Possible UPnP UUID Overflow Exploit Attempt from Internal Host - NOTIFY rev 2 2024-04-25
suricata ET MALWARE TA399/Sidewinder Maldoc Activity rev 2 2024-04-25
suricata ET EXPLOIT Possible WatchGuard CVE-2022-26318 RCE Attempt M3 rev 3 2024-04-25
suricata ET MALWARE MacOS/UpdateAgent.A CnC Activity M1 rev 3 2024-04-25
suricata ET MALWARE Meterpreter or Other Reverse Shell SSL Cert rev 4 2024-04-25
suricata ET MALWARE Win32/NitroStealer/exoStub CnC Exfil rev 3 2024-04-25
suricata ET MALWARE Unk.DPRK MalDoc SysInfo CnC Exfil rev 2 2024-04-25
suricata ET SCADA [nsacyber/ELITEWOLF] Siemens S7-1200 Default X509 Certificate String rev 2 2024-04-25
suricata ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara Default X509 Certificate rev 2 2024-04-25
suricata ET MALWARE Jupyter Stealer Reporting System Information M2 rev 2 2024-04-25
suricata ET HUNTING Observed Suspicious Request nc.exe in URI rev 2 2024-04-25
suricata ET MALWARE W32/Witch.3FA0!tr CnC Activity M2 rev 3 2024-04-25
suricata ET MALWARE MSIL/Khonsri Ransomware CnC Activity rev 2 2024-04-25
suricata ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraAX Default X509 Certificate String rev 2 2024-04-25
suricata ET HUNTING Possible UPnP UUID Overflow Exploit Attempt from Internal Host - SUBSCRIBE/UNSUBSCRIBE rev 2 2024-04-25
sigma Python Path Configuration File Creation - Windows test 2024-04-25
sigma Python Path Configuration File Creation - Linux test 2024-04-25
sigma Python Path Configuration File Creation - MacOS test 2024-04-25
sigma RegAsm.EXE Initiating Network Connection To Public IP test 2024-04-25
sigma PUA - SoftPerfect Netscan Execution test 2024-04-25
sigma Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation test 2024-04-25
snort ET TROJAN Win32/ProcessKiller CnC - Server Side rev 1 2024-04-24