Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Successful Apple iCloud Phish May 08 2017 rev 5 2024-04-18
suricata ET INFO Simplehelp Remote Administration Suite HTTP Server Value in Response rev 2 2024-04-18
suricata ET MALWARE MSIL/SkidRat CnC Checkin M2 rev 5 2024-04-18
sigma Gatekeeper Bypass via Xattr test 2024-04-18
sigma Linux Command History Tampering test 2024-04-17
sigma Cisco Duo Successful MFA Authentication Via Bypass Code test 2024-04-17
sigma Pnscan Binary Data Transmission Activity test 2024-04-16
snort ET CURRENT_EVENTS Successful Gmail Phish 2016-12-06 rev 3 2024-04-15
snort ET TROJAN Fileless infection dropped by EK CnC Beacon rev 2 2024-04-15
snort ET TROJAN CryptoWall Check-in M2 rev 4 2024-04-15
suricata ET PHISHING Possible Phishing Landing Page 2021-05-24 rev 3 2024-04-15
suricata ET WEB_SPECIFIC_APPS WordPress DB XML dump successful leakage rev 6 2024-04-15
suricata ET PHISHING Possible Phishing Landing Page 2021-05-18 rev 3 2024-04-15
suricata ET PHISHING Possible Successful CDC Coronavirus Related Phish 2020-04-07 rev 4 2024-04-15
suricata ET PHISHING Successful Gmail Phish 2016-12-06 rev 9 2024-04-15
suricata ET HUNTING Possible ELF executable sent when remote host claims to send a Text File rev 3 2024-04-15
suricata ET PHISHING Generic Credential Phish Redirection 2022-03-14 rev 4 2024-04-15
sigma Potential PowerShell Command Line Obfuscation test 2024-04-15
sigma Invoke-Obfuscation VAR+ Launcher test 2024-04-15
sigma Invoke-Obfuscation Via Use Clip - Powershell test 2024-04-15
sigma Invoke-Obfuscation STDIN+ Launcher test 2024-04-15
sigma Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE test 2024-04-15
suricata ET MALWARE Waledac Beacon Traffic Detected rev 10 2024-04-14
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.GORAT.[POST] rev 7 2024-04-14
suricata ET MALWARE DarkGate CNC Checkin rev 7 2024-04-14
suricata ET MALWARE Dorkbot GeoIP Lookup to wipmania rev 13 2024-04-14
suricata ET PHISHING Obfuscated Phishing Landing 2015-11-05 rev 5 2024-04-14
suricata ET MALWARE FBot Downloader Generic GET for ARM Payload rev 6 2024-04-14
suricata ET MALWARE Octopus Malware CnC Server Connectivity Check rev 5 2024-04-14
suricata ET MALWARE W32/Emotet.v4 Checkin rev 10 2024-04-14
suricata ET MALWARE MSIL/Spy.Keylogger.ENJ Variant CnC Activity rev 4 2024-04-14
suricata ET MALWARE Book of Eli CnC Checkin rev 9 2024-04-14
suricata ET SCAN abdullkarem Wordpress PHP Scanner rev 6 2024-04-14
suricata ET EXPLOIT_KIT Possible PurpleFox/RIG EK Flash Request M2 rev 5 2024-04-14
suricata ET MALWARE APT_NGO_wuaclt rev 8 2024-04-14
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice POST] rev 6 2024-04-14
suricata ET MALWARE Win32/Urausy.C response rev 6 2024-04-14
suricata ET MALWARE Possible Kelihos.F EXE Download Common Structure 2 rev 9 2024-04-14
suricata ET HUNTING suspicious - gzipped file via JAVA - could be pack200-ed JAR rev 6 2024-04-14
suricata ET MALWARE OilRig APT PowDesk Powershell Check rev 5 2024-04-14