Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING NHS Gov UK COVID-19 Landing Page rev 2 2024-04-04
suricata ET INFO CDXML Powershell File Request rev 3 2024-04-04
suricata ET INFO PSRC Powershell File Request rev 3 2024-04-04
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server 2] rev 5 2024-04-04
suricata ET ADWARE_PUP DownloadAssistant Activity rev 2 2024-04-04
suricata ET MALWARE CrownAdPro CnC Activity M3 rev 3 2024-04-04
suricata ET MALWARE MSIL/Juliens Botnet CnC Activity M1 rev 2 2024-04-04
suricata ET MALWARE Cobalt Strike Beacon Activity rev 3 2024-04-04
suricata ET MALWARE Win32/IcedID WebSocket Request M2 rev 2 2024-04-04
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server 3] rev 5 2024-04-04
suricata ET MALWARE FRAT Downloader Error Report POST rev 2 2024-04-04
suricata ET INFO File Uploaded to ge.tt Filesharing Service rev 4 2024-04-04
suricata ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M3 rev 4 2024-04-04
suricata ET INFO LumOffice Uploading Screenshot rev 3 2024-04-04
suricata ET MALWARE Jupyter Stealer CnC Checkin rev 4 2024-04-04
suricata ET MALWARE FRat WebSockets Request M2 rev 2 2024-04-04
suricata ET PHISHING Successful Chase Phish M1 Aug 15 2017 rev 4 2024-04-04
snort ET CURRENT_EVENTS Parrot TDS Check rev 2 2024-04-03
snort ET TROJAN Arechclient2 Backdoor/SecTopRAT Related Activity rev 1 2024-04-03
snort ET CURRENT_EVENTS Parrot TDS Cleared Response rev 2 2024-04-03
snort ET CURRENT_EVENTS Parrot TDS Malicious Response rev 2 2024-04-03
snort ET TROJAN Win32/FireStealer Related Server Response rev 1 2024-04-03
snort ET TROJAN Win32/frebniis IIS Backdoor Trigger Attempt M2 rev 2 2024-04-03
snort ET TROJAN Win32/frebniis IIS Backdoor Trigger Attempt M1 rev 2 2024-04-03
suricata ET MALWARE Bandit Stealer Config Inbound rev 2 2024-04-03
suricata GPL ATTACK_RESPONSE index of /cgi-bin/ response rev 9 2024-04-03
suricata GPL ATTACK_RESPONSE command error rev 11 2024-04-03
suricata ET INFO Smocker Server Mock Tool Response rev 3 2024-04-03
suricata ET MALWARE Maldoc CnC Checkin rev 2 2024-04-03
suricata ET INFO Terse Request For Bitbucket Snippet rev 3 2024-04-03
suricata GPL ATTACK_RESPONSE id check returned web rev 10 2024-04-03
suricata GPL INFO Linksys router default password login attempt rev 12 2024-04-03
suricata ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M6 rev 3 2024-04-03
suricata ET MALWARE Win32/frebniis IIS Backdoor Trigger Attempt M1 rev 2 2024-04-03
suricata ET MALWARE TA421 Wineloader CnC Checkin M4 rev 3 2024-04-03
suricata ET MALWARE Win32/Wacapew.C!ml CnC Checkin rev 2 2024-04-03
suricata ET MALWARE Win32/VB.PNU CnC Checkin rev 2 2024-04-03
suricata ET PHISHING Tech Support/Refund Scam Landing Inbound 2022/04/25 rev 3 2024-04-03
suricata ET MALWARE Win32/Generik.BUTNSNA Checkin rev 2 2024-04-03
suricata ET EXPLOIT_KIT Parrot TDS Check rev 3 2024-04-03