Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE [ESET] TA410 APT LookBack HTTP Server Response rev 3 2024-04-14
suricata ET MOBILE_MALWARE AdWare.AndroidOS.Ewind.cd Response rev 4 2024-04-14
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice Server] rev 6 2024-04-14
suricata ET MALWARE Moose CnC Response rev 7 2024-04-14
suricata ET MALWARE Generic - 8Char.JAR Naming Algorithm rev 8 2024-04-14
suricata ET MALWARE Moose CnC Request M2 rev 8 2024-04-14
suricata ET MOBILE_MALWARE signed-unsigned integer mismatch code-verification bypass rev 6 2024-04-14
suricata ET MALWARE MSIL/KeyRedirEx Banker Requesting Redirect/Inject List rev 5 2024-04-14
suricata ET MALWARE PE EXE or DLL Windows file download disguised as ASCII rev 7 2024-04-14
suricata ET P2P Ocelot BitTorrent Server in Use rev 5 2024-04-14
suricata ET ADWARE_PUP EZULA Spyware User Agent rev 29 2024-04-14
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES Server] rev 5 2024-04-14
suricata ET MALWARE W32/Jiwerks.A Checkin rev 7 2024-04-14
suricata ET WEB_SERVER Possible Cherokee Web Server GET AUX Request Denial Of Service Attempt rev 6 2024-04-14
suricata ET MALWARE Ixeshe/Mecklow Checkin 2 rev 10 2024-04-14
suricata ET INFO Certificate with Unknown Content M2 rev 3 2024-04-14
suricata ET MALWARE CozyDuke APT Possible SSL Cert 5 rev 6 2024-04-14
suricata ET INFO JAVA - Java Archive Download By Vulnerable Client rev 8 2024-04-14
suricata ET PHISHING Terse POST to Wordpress Folder - Probable Successful Phishing M7 rev 5 2024-04-14
suricata ET MALWARE eCh0raix/QNAPCrypt CnC Activity - Done rev 6 2024-04-14
suricata ET MALWARE Jaff Ransomware Checkin M1 rev 7 2024-04-14
suricata ET MALWARE Win32/TrojanDownloader.Waski.F Locker DL URI Struct Jul 25 2014 rev 7 2024-04-14
suricata ET ADWARE_PUP Suspicious User Agent EXE2 rev 7 2024-04-14
suricata ET ADWARE_PUP InstallCore PUA/Adware Activity M1 rev 6 2024-04-14
suricata ET WEB_SERVER JSP.SJavaWebManage WebShell Pass 20-09-2018 1 rev 4 2024-04-14
suricata ET MALWARE Win32/Trojan.Agent.AXMO CnC Beacon rev 6 2024-04-14
suricata ET HUNTING suspicious - uncompressed pack200-ed JAR rev 6 2024-04-14
suricata ET MALWARE Tinba Banker CnC Response rev 6 2024-04-14
suricata ET WEB_SERVER WebShell - Generic - c99shell based POST structure rev 5 2024-04-14
suricata ET MALWARE Potential Dridex.Maldoc Minimal Executable Request rev 12 2024-04-14
suricata ET MALWARE CozyDuke APT Possible SSL Cert 6 rev 6 2024-04-14
suricata ET MALWARE Cobalt Strike Malleable C2 OCSP Profile rev 7 2024-04-14
suricata ET MALWARE Zeus Bot GET to Bing checking Internet connectivity rev 7 2024-04-14
suricata ET MALWARE Possible Satan Cryptor GeoIP Lookup rev 3 2024-04-14
suricata ET PHISHING Successful DHL Account Phish 2015-11-03 rev 9 2024-04-14
suricata ET MALWARE Powersploit Framework Script Downloaded rev 4 2024-04-14
suricata ET MALWARE ConstructorWin32/Agent.V rev 13 2024-04-14
suricata ET MALWARE Possible TA410 APT FlowCloud Dependency Download rev 3 2024-04-14
suricata ET MALWARE W32/Echmark/MarkiRAT CnC Response rev 4 2024-04-14
suricata ET MALWARE f0xy Checkin rev 8 2024-04-14