Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Java Archive sent when remote host claims to send an image rev 7 2024-04-13
suricata ET PHISHING Successful HM Revenue & Customs Phish M1 Apr 07 2017 rev 6 2024-04-13
suricata ET MALWARE Scarlet Mimic DNS Lookup 27 rev 6 2024-04-13
suricata ET MALWARE Sofacy DNS Lookup symanttec.org rev 7 2024-04-13
suricata ET MALWARE Observed SystemBC CnC Domain in DNS Query rev 3 2024-04-13
suricata ET PHISHING Successful Paypal Phish M2 2016-11-17 rev 7 2024-04-13
suricata ET PHISHING Successful US Bank Phish M1 2015-12-22 rev 7 2024-04-13
suricata ET PHISHING Successful Mailbox Shutdown Phish M1 2016-05-16 rev 6 2024-04-13
suricata ET MALWARE Observed AridViper CnC Domain in TLS SNI rev 3 2024-04-13
suricata ET MALWARE ShellCrew.APT StreamEx DNS Lookup 1 rev 6 2024-04-13
suricata ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain rev 6 2024-04-13
suricata ET MALWARE Win32/Comisproc Checkin rev 11 2024-04-13
suricata ET MALWARE Observed AridViper CnC Domain in TLS SNI rev 3 2024-04-13
suricata ET MOBILE_MALWARE DNS Query for gongfu-android.com DroidKungFu CnC Server rev 7 2024-04-13
suricata ET PHISHING Successful Ourtime.com Phish 2016-11-28 rev 7 2024-04-13
suricata ET MALWARE Gamaredon CnC Domain in DNS Lookup rev 4 2024-04-13
suricata ET MALWARE Observed SystemBC CnC Domain in DNS Query rev 3 2024-04-13
suricata ET MALWARE Observed SystemBC CnC Domain in DNS Query rev 3 2024-04-13
suricata ET PHISHING Generic Personalized Google Firebase Hosted Phishing Landing rev 3 2024-04-13
suricata ET PHISHING Successful Apple Store Phish M2 2016-12-29 rev 6 2024-04-13
suricata ET PHISHING Successful Apple Phish 2016-10-05 rev 7 2024-04-13
suricata ET INFO IncrediMail Install Callback rev 6 2024-04-13
suricata ET PHISHING Successful Yahoo Phish 2016-09-27 rev 7 2024-04-13
suricata ET MALWARE CDT Credphish/Netwire Campaign DNS Lookup rev 6 2024-04-13
suricata ET PHISHING Successful Excel Phish 2016-11-17 rev 8 2024-04-13
suricata ET HUNTING Suspicious HTTP POST Only Containing Pass - Possible Phishing rev 3 2024-04-13
suricata ET PHISHING Successful US Bank Phish M2 2015-12-22 rev 7 2024-04-13
suricata ET PHISHING Successful Paypal Phish 2015-10-28 3 rev 5 2024-04-13
suricata ET PHISHING Successful Barclays Phish M1 2016-09-09 rev 6 2024-04-13
suricata ET MALWARE MSIL/KeyRedirEx Banker Receiving Exit Instruction rev 6 2024-04-13
suricata ET PHISHING Successful Gmail Account Update Phish 2016-05-10 rev 7 2024-04-13
suricata ET PHISHING Successful Generic Webmail Phish 2016-12-02 rev 7 2024-04-13
suricata ET MALWARE Possible Winnti-related DNS Lookup rev 6 2024-04-13
suricata ET PHISHING Successful Google Drive Phish 2016-01-12 rev 7 2024-04-13
suricata ET MALWARE Chanitor Variant .onion Proxy Domain rev 5 2024-04-13
suricata ET SCAN Grabber.py Web Scan Detected rev 9 2024-04-13
suricata ET PHISHING Successful Gmail Phish 2015-11-05 rev 8 2024-04-13
suricata ET PHISHING Successful DHL Phish 2016-10-18 rev 5 2024-04-13
suricata ET MALWARE Possible Winnti-related DNS Lookup rev 6 2024-04-13
suricata ET PHISHING Successful Apple Suspended Account Phish M2 Aug 09 2016 rev 7 2024-04-13