Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET EXPLOIT_KIT Capesand EK Landing rev 2 2024-03-14
suricata ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server rev 3 2024-03-14
suricata ET PHISHING Microsoft Account Phishing Landing 2018-08-07 rev 2 2024-03-14
suricata ET INFO Possible SSLv2 Negotiation in Progress Client Master Key SSL2_RC2_128_CBC_EXPORT40_WITH_MD5 rev 3 2024-03-14
suricata ET EXPLOIT_KIT SunDown EK RIP Landing M1 B641 rev 3 2024-03-14
suricata ET MALWARE WEBC2-KT3 Intial Connection Beacon Server Response APT1 Related rev 5 2024-03-14
suricata ET PHISHING Fake Webmail Account Phishing Landing 2015-09-10 rev 4 2024-03-14
suricata ET PHISHING Facebook Phishing Landing 2018-02-14 rev 2 2024-03-14
suricata ET EXPLOIT_KIT Evil Redirect Leading to EK Mar 18 2016 rev 3 2024-03-14
suricata ET PHISHING Email Account Exceeded Quota Phishing Landing 2016-07-11 rev 3 2024-03-14
suricata ET PHISHING Successful Generic Adobe Phish 2019-07-29 rev 2 2024-03-14
suricata ET PHISHING Successful DHL Phish 2015-09-14 rev 5 2024-03-14
suricata ET MALWARE NanoCore RAT Keepalive 2 rev 3 2024-03-14
suricata ET PHISHING Chase Account Phish Landing Oct 22 rev 3 2024-03-14
suricata ET EXPLOIT_KIT Disdain EK Flash Exploit M3 Aug 23 2017 rev 3 2024-03-14
suricata ET PHISHING Generic PhishKit Author Comment M8 2018-08-30 rev 2 2024-03-14
suricata ET PHISHING Apple Phishing Landing Nov 10 2017 rev 3 2024-03-14
suricata ET EXPLOIT_KIT RIG EK Payload Jul 05 2016 rev 3 2024-03-14
suricata ET MALWARE Possible Veil Powershell Encoder B643 rev 3 2024-03-14
suricata ET MALWARE OSX/WireLurker CnC Beacon rev 5 2024-03-14
suricata ET WEB_SERVER Generic WSO Webshell Password Prompt Accessed on Internal Compromised Server rev 3 2024-03-14
suricata ET PHISHING Successful Survey Credential Phish 2015-08-12 rev 5 2024-03-14
suricata ET PHISHING GitLab Phishing Landing 2018-07-19 rev 3 2024-03-14
suricata ET PHISHING Outlook WebApp Phish Landing 2015-11-05 rev 3 2024-03-14
suricata ET PHISHING WeTransfer Phishing Landing 2018-08-30 rev 2 2024-03-14
suricata ET EXPLOIT_KIT SNET EK Encoded VBS 2 rev 4 2024-03-14
suricata ET PHISHING Successful Generic Phish M2 2016-10-27 rev 5 2024-03-14
suricata ET INFO Outbound MSSQL Connection to Non-Standard Port - Likely Malware rev 5 2024-03-14
suricata ET MALWARE OSX/Mokes.A CnC Heartbeat rev 3 2024-03-14
suricata ET DOS Possible Memcached DDoS Amplification Response Outbound rev 2 2024-03-14
suricata ET INFO Possible SSLv2 Negotiation in Progress Client Master Key SSL2_DES_64_CBC_WITH_MD5 rev 3 2024-03-14
suricata ET EXPLOIT_KIT ScanBox Jun 06 2015 M1 T1 rev 4 2024-03-14
suricata ET MALWARE Possible SharpShooter Framework Generated Script rev 2 2024-03-14
suricata GPL NETBIOS SMB llsrpc little endian bind attempt rev 5 2024-03-14
suricata ET EXPLOIT_KIT KaiXin Landing M4 rev 5 2024-03-14
suricata ET TELNET busybox MEMES Hackers - Possible Brute Force Attack rev 3 2024-03-14
suricata ET EXPLOIT_KIT Probable Sakura exploit kit landing page obfuscated applet tag Mar 1 2013 rev 5 2024-03-14
suricata ET EXPLOIT_KIT Nuclear EK Gate Injected iframe Oct 22 2014 rev 4 2024-03-14
suricata ET ADWARE_PUP Suspicious Darkwave Popads Pop Under Redirect rev 3 2024-03-14
suricata GPL NETBIOS SMB irot unicode little endian bind attempt rev 5 2024-03-14