Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET ATTACK_RESPONSE passwd file Outbound from WEB SERVER Linux rev 2 2024-03-14
suricata ET EXPLOIT_KIT SUSPICIOUS Grey Advertising Often Leading to EK rev 4 2024-03-14
suricata GPL NETBIOS DCERPC msqueue bind attempt rev 6 2024-03-14
suricata ET PHISHING Possible Google Docs Phishing Landing - Title over non SSL rev 2 2024-03-14
suricata ET PHISHING GitLab Phishing Landing 2018-07-19 rev 3 2024-03-14
suricata ET PHISHING Email Account Exceeded Quota Phishing Landing 2016-07-11 rev 3 2024-03-14
suricata ET PHISHING Successful Generic Phish M2 2016-10-27 rev 5 2024-03-14
suricata ET MALWARE NanoCore RAT Keepalive 2 rev 3 2024-03-14
suricata ET PHISHING Facebook Mobile Phishing Landing 2018-02-26 rev 2 2024-03-14
suricata ET MALWARE OSX/WireLurker CnC Beacon rev 5 2024-03-14
suricata ET PHISHING Chase Account Phish Landing Oct 22 rev 3 2024-03-14
suricata ET MALWARE WEBC2-KT3 Intial Connection Beacon Server Response APT1 Related rev 5 2024-03-14
suricata ET EXPLOIT_KIT ScanBox Jun 06 2015 M1 T1 rev 4 2024-03-14
suricata ET INFO Possible SSLv2 Negotiation in Progress Client Master Key SSL2_DES_64_CBC_WITH_MD5 rev 3 2024-03-14
suricata ET PHISHING Chase Phishing Landing 2018-03-28 rev 2 2024-03-14
suricata ET PHISHING Possible Apple Store Phish Landing 2015-07-30 rev 4 2024-03-14
suricata GPL NETBIOS SMB-DS winreg bind attempt rev 5 2024-03-14
suricata ET TELNET busybox ECCHI hackers - Possible Brute Force Attack rev 3 2024-03-14
suricata ET HUNTING SUSPICIOUS Path to BusyBox rev 3 2024-03-14
suricata ET MALWARE nspps Backdoor - Task Response rev 2 2024-03-14
suricata ET EXPLOIT_KIT SunDown EK RIP Landing M4 B642 rev 3 2024-03-14
suricata ET EXPLOIT_KIT SofosFO/GrandSoft landing applet plus class Mar 03 2013 rev 6 2024-03-14
suricata GPL NETBIOS SMB ISystemActivator bind attempt rev 5 2024-03-14
suricata ET MALWARE Possible Malicious Gzip PowerShell over HTTP rev 3 2024-03-14
suricata ET EXPLOIT Ghostscript invalidcheck escape attempt rev 2 2024-03-14
suricata ET MALWARE DarkComet-RAT server join acknowledgement rev 5 2024-03-14
suricata ET WEB_CLIENT DRIVEBY GENERIC CollectGarbage in Hex String No Seps rev 3 2024-03-14
suricata ET INFO Petite Packed Binary Download rev 9 2024-03-14
suricata ET WEB_CLIENT SocEng Fake Font Download Template Nov 14 2017 rev 3 2024-03-14
suricata ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound rev 3 2024-03-14
suricata ET WEB_CLIENT pshell dl/execute primitives in wideb64 3 rev 3 2024-03-14
suricata ET MALWARE Possibly Malicious Double Base64 Unicode Net.ServicePointManager M3 rev 4 2024-03-14
suricata ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon Response rev 4 2024-03-14
suricata ET PHISHING Successful Fake Webmail Quota Phish 2015-09-10 rev 5 2024-03-14
suricata ET INFO Vulnerable Java Version 1.7.x Detected rev 64 2024-03-14
suricata ET PHISHING Google Drive Phishing Landing 2015-07-28 rev 4 2024-03-14
suricata ET PHISHING Adobe Shared Document Phish Landing 2015-11-14 rev 5 2024-03-14
suricata ET PHISHING Microsoft Account Phishing Landing M1 2018-04-19 rev 2 2024-03-14
suricata ET PHISHING Alibaba Phishing Landing 2018-08-07 rev 2 2024-03-14
suricata ET CHAT IRC NICK command rev 21 2024-03-14