Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE [PTsecurity] Gozi/Ursnif Payload v14 rev 4 2024-04-13
suricata ET MALWARE Observed SystemBC CnC Domain in DNS Query rev 3 2024-04-13
suricata ET EXPLOIT Dell KACE Attempted Remote Command Injection Inbound rev 5 2024-04-13
suricata ET USER_AGENTS Binget PHP Library User Agent Outbound rev 5 2024-04-13
suricata ET PHISHING Successful Tradekey Phish 2015-11-19 rev 7 2024-04-13
suricata ET MALWARE Possible Winnti-related DNS Lookup rev 6 2024-04-13
suricata ET MALWARE ELF.SystemdMiner C2 Domain in DNS Lookup rev 5 2024-04-13
suricata ET USER_AGENTS Tear Application User-Agent Detected rev 10 2024-04-13
suricata ET PHISHING Successful Chase Phish 2015-09-24 rev 7 2024-04-13
suricata ET MALWARE CenterPOS CnC rev 5 2024-04-13
suricata ET HUNTING Suspicious HTTP Referer C Drive Path rev 7 2024-04-13
suricata ET MALWARE Sofacy DNS Lookup adobeincorp.com rev 7 2024-04-13
suricata ET PHISHING Successful Alibaba Phish 2016-10-18 rev 6 2024-04-13
suricata ET EXPLOIT_KIT SUSPICIOUS DNS Request for Grey Advertising Often Leading to EK rev 7 2024-04-13
suricata ET MALWARE W32.Razy Inject Domain in DNS Lookup rev 5 2024-04-13
suricata ET MALWARE ShellCrew.APT StreamEx DNS Lookup 13 rev 6 2024-04-13
suricata ET ADWARE_PUP Loadmoney.A Checkin 5 rev 9 2024-04-13
suricata ET PHISHING Successful Apple ID Phish M1 2016-10-04 rev 7 2024-04-13
suricata ET PHISHING Successful WhatsApp Phish M2 2016-12-07 rev 5 2024-04-13
suricata ET EXPLOIT Possible Linksys WAP54Gv3 Remote Debug Root Shell Exploitation Attempt rev 4 2024-04-13
suricata ET MALWARE ProjectSauron Remsec/HTTPBrowser/Pisloader Covert DNS CnC Channel TXT Lookup rev 10 2024-04-13
suricata ET MALWARE Possible Winnti-related DNS Lookup rev 6 2024-04-13
suricata ET PHISHING Successful Excel Online Phish 2015-12-08 rev 9 2024-04-13
suricata ET MALWARE ABUSE.CH Ransomware/Cerber Onion Domain Lookup rev 5 2024-04-13
suricata ET PHISHING Successful USAA Phish 2015-10-20 rev 7 2024-04-13
suricata ET EXPLOIT_KIT Possible Malvertising EK Redirect to EK M2 rev 4 2024-04-13
suricata ET WEB_SERVER DNS Query for Suspicious e5b57288.com Domain - Anuna Checkin - Compromised PHP Site rev 7 2024-04-13
suricata ET MALWARE RDP Brute Force Bot Checkin rev 10 2024-04-13
suricata ET MALWARE Glupteba CnC Domain in DNS Lookup rev 4 2024-04-13
suricata ET EXPLOIT Eir D1000 Remote Command Injection Attempt Inbound rev 3 2024-04-13
suricata ET MALWARE DNS Query for Cloud Atlas blackberry-support.herokuapp.com rev 7 2024-04-13
suricata ET PHISHING Successful iCloud Phish Oct 10 2016 rev 6 2024-04-13
suricata ET PHISHING Possible Successful Fedex Phish 2015-07-28 rev 7 2024-04-13
suricata ET PHISHING Successful Generic Personalized Phish 2019-03-11 rev 3 2024-04-13
suricata ET PHISHING Successful Phish OWA Credentials 2016-08-16 rev 6 2024-04-13
suricata ET MALWARE Glupteba CnC Domain in DNS Lookup rev 4 2024-04-13
suricata ET MALWARE ShellCrew.APT StreamEx DNS Lookup 23 rev 6 2024-04-13
suricata ET PHISHING Successful Facebook Phish 2016-10-12 rev 7 2024-04-13
suricata ET MALWARE ServHelper CnC Inital Checkin rev 4 2024-04-13
suricata ET MALWARE Observed SystemBC CnC Domain in DNS Query rev 3 2024-04-13