Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE NanoCore RAT Keepalive Response 3 rev 7 2024-03-14
suricata ET EXPLOIT_KIT DRIVEBY Router DNS Changer Apr 07 2015 M2 rev 4 2024-03-14
suricata ET PHISHING Horde Webmail Phishing Landing 2015-08-21 rev 5 2024-03-14
suricata ET INFO Possible SSLv2 Negotiation in Progress Client Master Key SSL2_RC2_128_CBC_EXPORT40_WITH_MD5 rev 3 2024-03-14
suricata GPL NETBIOS DCERPC msqueue little endian bind attempt rev 6 2024-03-14
suricata ET WEB_CLIENT pshell dl/execute primitives in wideb64 2 rev 3 2024-03-14
suricata ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M2 rev 4 2024-03-14
suricata ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded Credential ConfigSyncProc Login Attempt rev 2 2024-03-14
suricata GPL NETBIOS SMB-DS ISystemActivator unicode bind attempt rev 5 2024-03-14
suricata ET EXPLOIT Possible MeltDown PoC Download In Progress rev 3 2024-03-14
suricata ET MALWARE NanoCore RAT Keepalive Response 2 rev 11 2024-03-14
suricata ET CHAT GaduGadu Chat Client Login Packet rev 5 2024-03-14
suricata ET EXPLOIT_KIT SunDown EK RIP Landing M1 B641 rev 3 2024-03-14
suricata ET MALWARE WaterDropX PRISM CnC Checkin rev 3 2024-03-14
suricata ET PHISHING Microsoft Account Phishing Landing M2 2018-04-19 rev 3 2024-03-14
suricata ET EXPLOIT_KIT Terror EK Payload Download M2 Mar 14 2017 rev 2 2024-03-14
suricata ET MALWARE Mystic Stealer C2 Client Hello Packet rev 4 2024-03-14
suricata ET PHISHING DHL Phishing Landing 2016-07-11 rev 4 2024-03-14
suricata ET EXPLOIT F5 BIG-IP rsync cmi authorized_keys successful upload rev 5 2024-03-14
suricata ET PHISHING Possible Adobe ID Phishing Landing - Title over non SSL rev 3 2024-03-14
suricata ET PHISHING Facebook Phishing Landing 2018-02-13 M2 rev 3 2024-03-14
suricata ET WEB_CLIENT Tech Support Phone Scam Landing 2018-01-10 rev 4 2024-03-14
suricata ET PHISHING Wells Fargo Phishing Landing 2018-02-01 rev 2 2024-03-14
suricata GPL NETBIOS SMB nddeapi create tree attempt rev 6 2024-03-14
suricata ET PHISHING Successful Outlook Webmail Phishing 2015-11-21 rev 3 2024-03-14
suricata ET EXPLOIT_KIT Internet Explorer Information Disclosure Vuln as Observed in RIG EK Prefilter M2 Dec 06 rev 4 2024-03-14
suricata ET PHISHING AT&T Phishing Landing 2018-08-30 rev 3 2024-03-14
suricata ET PHISHING Bank of America Phishing Landing 2018-01-18 M2 rev 2 2024-03-14
suricata ET MALWARE OSX/Mokes.A CnC Heartbeat rev 3 2024-03-14
suricata ET PHISHING Successful Generic Phish M2 2016-10-27 rev 5 2024-03-14
suricata ET PHISHING Email Account Exceeded Quota Phishing Landing 2016-07-11 rev 3 2024-03-14
suricata ET PHISHING GitLab Phishing Landing 2018-07-19 rev 3 2024-03-14
suricata ET PHISHING Possible Google Docs Phishing Landing - Title over non SSL rev 2 2024-03-14
suricata GPL NETBIOS DCERPC msqueue bind attempt rev 6 2024-03-14
suricata ET EXPLOIT_KIT SUSPICIOUS Grey Advertising Often Leading to EK rev 4 2024-03-14
suricata ET ATTACK_RESPONSE passwd file Outbound from WEB SERVER Linux rev 2 2024-03-14
suricata ET EXPLOIT_KIT Redkit Landing Page URL March 03 2013 rev 8 2024-03-14
suricata ET PHISHING Generic PhishKit Author Comment M8 2018-08-30 rev 2 2024-03-14
suricata ET WEB_SERVER Generic WSO Webshell Password Prompt Accessed on Internal Compromised Server rev 3 2024-03-14
suricata ET WEB_CLIENT Fake AV Phone Scam Landing July 20 2015 M4 rev 4 2024-03-14