Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Successful Docusign Phish 2016-11-17 rev 7 2024-04-13
suricata ET MOBILE_MALWARE Android Syria-Twitter Checkin rev 5 2024-04-13
suricata ET SCAN Toata Scanner User-Agent Detected rev 11 2024-04-13
suricata ET PHISHING Successful Google Drive Phish 2016-10-11 rev 5 2024-04-13
suricata ET PHISHING Monzo Credential Phish Landing Page 2022-02-17 rev 3 2024-04-13
suricata ET ADWARE_PUP Win32/GameHack.DJC CnC Activity rev 3 2024-04-13
suricata ET PHISHING Successful Excel Phish 2016-08-19 rev 7 2024-04-13
suricata ET MALWARE Mirai Botnet Domain Observed rev 6 2024-04-13
suricata ET USER_AGENTS WinRM User Agent Detected - Possible Lateral Movement rev 5 2024-04-13
suricata ET MOBILE_MALWARE Apple iPhone Implant - Upload Files rev 3 2024-04-13
suricata ET PHISHING Successful Dropbox Phish 2016-09-29 rev 6 2024-04-13
suricata ET PHISHING Successful Paypal Phish M2 Aug 14 2017 rev 4 2024-04-13
suricata ET ADWARE_PUP SearchProtect PUA User-Agent Observed rev 5 2024-04-13
suricata ET PHISHING Successful Discover Phish M3 2016-12-14 rev 9 2024-04-13
suricata ET MALWARE OSX/WireLurker DNS Query Domain www.comeinbaby.com rev 8 2024-04-13
suricata ET GAMES Wolfteam HileYapak Server Response rev 6 2024-04-13
suricata ET PHISHING Successful Facebook Phish M1 2016-09-30 rev 5 2024-04-13
suricata ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Femas.b DNS Lookup rev 6 2024-04-13
suricata ET ADWARE_PUP APN/Ask Toolbar PUA/PUP User-Agent rev 6 2024-04-13
suricata ET MALWARE CDT Credphish/Netwire Campaign DNS Lookup rev 6 2024-04-13
suricata ET PHISHING Successful Bank of Oklahoma Phish M1 Jul 21 2016 rev 7 2024-04-13
suricata ET ADWARE_PUP Win32.LoadMoney User Agent 2 rev 5 2024-04-13
suricata ET PHISHING Successful FR Carte Bleue / BCP Phish 2016-09-06 rev 6 2024-04-13
suricata ET MOBILE_MALWARE Apple iPhone Implant - Command Executed rev 3 2024-04-13
suricata ET DNS DNS Query for vpnoverdns - indicates DNS tunnelling rev 7 2024-04-13
suricata ET MALWARE W32/Kbot.Backdoor Variant CnC Beacon rev 6 2024-04-13
suricata ET PHISHING Successful Wildblue Phishing M2 2015-11-24 rev 7 2024-04-13
suricata ET PHISHING Successful Sparkasse Credential Phish M1 2022-04-13 rev 3 2024-04-13
suricata ET PHISHING Successful Alibaba Phish 2016-12-20 rev 7 2024-04-13
suricata ET INFO Hotmail Inbox Access rev 7 2024-04-13
suricata ET PHISHING Successful Banco do Brasil Phish M2 Sep 29 2017 rev 4 2024-04-13
suricata ET PHISHING Successful USAA Phish 2016-11-22 rev 8 2024-04-13
suricata ET PHISHING Successful Adobe Shared Document Phish 2016-11-15 rev 6 2024-04-13
suricata ET PHISHING Successful Apple Phish M1 2016-09-14 rev 6 2024-04-13
suricata ET MALWARE Sofacy DNS Lookup scanmalware.info rev 7 2024-04-13
suricata ET MALWARE APT32 Win32/Ratsnif Requesting Command from CnC rev 4 2024-04-13
suricata ET MALWARE Cayosin Botnet User-Agent Observed M2 rev 6 2024-04-13
suricata ET MALWARE Critroni Variant .onion Proxy Domain rev 5 2024-04-13
suricata ET MALWARE Observed DNS Query to Gryphon CnC Domain / GlobeImposter Payment Domain rev 6 2024-04-13
suricata ET PHISHING Successful Wells Fargo Phish M2 2016-11-18 rev 7 2024-04-13