Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Possible Compromised Wordpress - Generic Phishing Landing 2018-01-22 rev 3 2024-04-12
suricata ET PHISHING Successful Wells Fargo Phish 2018-03-12 rev 3 2024-04-12
suricata ET MALWARE W32/SpeedingUpMyPC.Rootkit Successful Install GET Type CnC Beacon rev 8 2024-04-12
suricata ET MALWARE W32/Karagany.Downloader CnC Beacon rev 4 2024-04-12
suricata ET MALWARE MINEBRIDGE CnC Response rev 3 2024-04-12
suricata ET MALWARE Sinowal/sinonet/mebroot/Torpig infected host POSTing process list rev 7 2024-04-12
suricata ET MALWARE W32/SpeedingUpMyPC.Rootkit Install CnC Beacon rev 4 2024-04-12
suricata ET MALWARE Win32.HLLW.Autoruner USA_Load UA rev 5 2024-04-12
suricata ET PHISHING Successful Phish Outlook Credentials Oct 01 2015 rev 6 2024-04-12
suricata ET MALWARE W32/Neverquest.InfoStealer Configuration Request CnC Beacon rev 4 2024-04-12
suricata ET MALWARE Windows Executable Downloaded With Image Content-Type Header rev 3 2024-04-12
suricata ET MALWARE W32/Echmark/MarkiRAT CnC Host Checkin rev 3 2024-04-12
suricata ET PHISHING Successful Bank of America Phish M1 Oct 01 2012 rev 6 2024-04-12
suricata ET MOBILE_MALWARE CoolReaper CnC Beacon 2 rev 5 2024-04-12
suricata ET INFO Application Crash Report Sent to Microsoft rev 7 2024-04-12
suricata ET EXPLOIT Possible Elasticsearch CVE-2015-1427 Exploit Campaign SSL Certificate rev 4 2024-04-12
suricata ET PHISHING Successful Google Drive Phish June 17 2015 rev 7 2024-04-12
suricata ET MALWARE Possible UPSTYLE Command Attempt rev 1 2024-04-12
suricata ET INFO iTunes User Agent rev 10 2024-04-12
sigma Kubernetes Unauthorized or Unauthenticated Access test 2024-04-12
snort ET INFO Set flow on bmp file get rev 7 2024-04-11
snort ET CURRENT_EVENTS Privnote Landing Page 2024-04-11 rev 1 2024-04-11
snort ET SCAN ProxyReconBot CONNECT method to Mail rev 11 2024-04-11
suricata ET ATTACK_RESPONSE x2300 phpshell detected rev 9 2024-04-11
suricata ET ADWARE_PUP SpywareLabs VirtualBouncer Seeking Instructions rev 15 2024-04-11
suricata ET ATTACK_RESPONSE r57 phpshell footer detected rev 10 2024-04-11
suricata ET SCAN ProxyReconBot CONNECT method to Mail rev 10 2024-04-11
suricata ET WEB_SERVER MSSQL Server OLEDB asp error rev 14 2024-04-11
suricata ET ADWARE_PUP Searchmiracle.com Spyware Installer silent.exe Download rev 14 2024-04-11
suricata ET ADWARE_PUP PUP/PUA OSSProxy HTTP Header rev 15 2024-04-11
suricata ET ADWARE_PUP Webhancer Data Upload rev 13 2024-04-11
suricata ET HUNTING Set flow on bmp file get rev 10 2024-04-11
suricata ET ADWARE_PUP Webhancer Data Post rev 17 2024-04-11
suricata ET WEB_CLIENT Encoded javascriptdocument.write - usually hostile rev 11 2024-04-11
suricata ET PHISHING Privnote Landing Page 2024-04-11 rev 1 2024-04-11
suricata ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- aramayap.asp kelimeler DELETE rev 11 2024-04-11
snort ET TROJAN Possible Windows executable sent when remote host claims to send html content rev 11 2024-04-10
snort ET TROJAN Possible Windows executable sent when remote host claims to send HTML/CSS Content rev 7 2024-04-10
snort ET TROJAN Suspected Trojan-Proxy Web Socket Connection Activity rev 1 2024-04-10
suricata ET WEB_SPECIFIC_APPS Papoo CMS message_class.php pfadhier Local File Inclusion rev 8 2024-04-10