Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Possible Scotiabank Phishing Landing - Title over non SSL rev 2 2024-03-14
suricata ET PHISHING Facebook Phishing Landing 2018-04-09 rev 2 2024-03-14
suricata ET PHISHING [eSentire] OneDrive Phishing Landing 2018-06-15 rev 2 2024-03-14
suricata ET EXPLOIT Possible CVE-2016-2209 Symantec PowerPoint Parsing Buffer Overflow M1 rev 3 2024-03-14
suricata ET WEB_CLIENT Suspicious PHP UNZIP Tool Accessed on External Possibly Compromised Server rev 2 2024-03-14
suricata ET MALWARE NanoCore RAT Keepalive Response 2 rev 11 2024-03-14
suricata GPL NETBIOS SMB nddeapi create tree attempt rev 6 2024-03-14
suricata ET EXPLOIT Possible SAP NetWeaver CVE-2020-6287 Probe rev 3 2024-03-14
suricata ET WEB_CLIENT Oracle Java 6 Object Tag launchjnlp docbase Parameters Flowbits Set rev 4 2024-03-14
suricata ET PHISHING Successful Outlook Webmail Phishing 2015-11-21 rev 3 2024-03-14
suricata GPL NETBIOS SMB-DS ISystemActivator unicode bind attempt rev 5 2024-03-14
suricata ET EXPLOIT_KIT SunDown EK RIP Landing M1 B641 rev 3 2024-03-14
suricata ET PHISHING Google Drive Phishing Landing M1 July 24 2015 rev 5 2024-03-14
suricata ET MALWARE Likely Evil EXE download from WinHttpRequest non-exe extension rev 4 2024-03-14
suricata ET PHISHING Possible Capitech Internet Banking Phishing Landing - Title over non SSL rev 3 2024-03-14
suricata GPL NETBIOS SMB-DS winreg unicode bind attempt rev 5 2024-03-14
suricata ET PHISHING Mailbox Verification Phishing Landing 2018-02-07 rev 2 2024-03-14
suricata ET PHISHING Wells Fargo Phishing Landing 2018-02-02 M6 rev 2 2024-03-14
suricata ET PHISHING Hellion Postmaster Phishing Landing 2018-01-31 rev 2 2024-03-14
suricata ET PHISHING Wells Fargo Phishing Landing 2018-02-02 M5 rev 2 2024-03-14
suricata ET MALWARE WEBC2-KT3 Intial Connection Beacon APT1 Related rev 3 2024-03-14
suricata ET HUNTING SUSPICIOUS Local file read using read protocol rev 3 2024-03-14
suricata ET WEB_CLIENT DRIVEBY GENERIC ShellExecute in URLENCODE rev 3 2024-03-14
suricata ET PHISHING Dropbox Phishing Landing 2018-01-18 rev 2 2024-03-14
suricata ET EXPLOIT_KIT SUSPICIOUS Grey Advertising Often Leading to EK rev 4 2024-03-14
suricata ET PHISHING Successful Generic Miarroba Phish 2019-07-11 rev 2 2024-03-14
suricata ET INFO Possible SSLv2 Negotiation in Progress Client Master Key SSL2_DES_64_CBC_WITH_MD5 rev 3 2024-03-14
suricata GPL NETBIOS SMB-DS irot little endian bind attempt rev 5 2024-03-14
suricata ET PHISHING Adobe Shared Document Phish Landing 2015-11-14 rev 5 2024-03-14
suricata ET INFO SMB Executable File Transfer rev 3 2024-03-14
suricata ET INFO Onion/TOR Proxy Client Request rev 3 2024-03-14
suricata GPL NETBIOS SMB-DS ISystemActivator little endian bind attempt rev 5 2024-03-14
suricata ET PHISHING Upgrade Advantage Phishing Landing 2018-02-22 rev 2 2024-03-14
suricata ET PHISHING Google Drive Phishing Landing M2 July 24 2015 rev 4 2024-03-14
suricata ET WEB_CLIENT DRIVEBY GENERIC ShellExecute in Hex No Seps rev 3 2024-03-14
suricata ET PHISHING Banque Populaire Phishing Landing 2018-02-05 rev 2 2024-03-14
suricata ET PHISHING Verizon Wireless Phishing Landing 2018-01-30 rev 2 2024-03-14
suricata ET EXPLOIT_KIT Cool Exploit Kit Plugin-Detect July 08 2013 rev 4 2024-03-14
suricata ET ATTACK_RESPONSE passwd file Outbound from WEB SERVER Linux rev 2 2024-03-14
suricata ET EXPLOIT_KIT Redkit Landing Page URL March 03 2013 rev 8 2024-03-14