Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Microsoft Account Phishing Landing 2018-08-07 rev 2 2024-03-14
suricata ET MALWARE CozyDuke APT HTTP CnC Beacon Response rev 4 2024-03-14
suricata ET PHISHING Possible Adobe ID Phishing Landing - Title over non SSL rev 3 2024-03-14
suricata ET PHISHING DHL Phishing Landing 2016-07-11 rev 4 2024-03-14
suricata ET PHISHING Wells Fargo Phishing Landing 2018-02-02 M5 rev 2 2024-03-14
suricata ET MALWARE Mystic Stealer C2 Client Hello Packet rev 4 2024-03-14
suricata ET MALWARE Possible malicious Office doc hidden in XML file rev 3 2024-03-14
suricata ET PHISHING Facebook Phishing Landing 2018-04-09 rev 2 2024-03-14
suricata GPL NETBIOS SMB-DS nddeapi unicode create tree attempt rev 6 2024-03-14
suricata ET PHISHING Cloud Drive Phish Landing 2015-08-12 rev 4 2024-03-14
suricata ET EXPLOIT Possible CVE-2016-2209 Symantec PowerPoint Parsing Buffer Overflow M1 rev 3 2024-03-14
suricata ET GAMES Growtopia Hack - WrongGrow CnC Activity rev 2 2024-03-14
suricata GPL NETBIOS SMB-DS winreg unicode bind attempt rev 5 2024-03-14
suricata ET WEB_CLIENT Oracle Java 6 Object Tag launchjnlp docbase Parameters Flowbits Set rev 4 2024-03-14
suricata ET MALWARE Covenant Framework HTTP Hello World Server Response rev 2 2024-03-14
suricata ET EXPLOIT_KIT SunDown EK RIP Landing M1 B641 rev 3 2024-03-14
suricata ET EXPLOIT F5 BIG-IP rsync cmi authorized_keys successful upload rev 5 2024-03-14
suricata ET PHISHING Facebook Phishing Landing 2018-02-13 M2 rev 3 2024-03-14
suricata ET INFO Exe32Pack Packed Executable Download rev 3 2024-03-14
suricata GPL NETBIOS SMB irot bind attempt rev 5 2024-03-14
suricata ET CHAT IRC USER Off-port Likely bot with 0 0 colon checkin rev 3 2024-03-14
suricata ET MALWARE NanoCore RAT Keepalive Response 2 rev 11 2024-03-14
suricata GPL CHAT IRC DCC file transfer request rev 13 2024-03-14
suricata ET PHISHING Paypal Phishing Landing 2018-05-09 rev 2 2024-03-14
suricata ET CHAT GaduGadu Chat Client Login Packet rev 5 2024-03-14
suricata ET PHISHING Capital One Phishing Landing 2018-02-13 M1 rev 3 2024-03-14
suricata ET EXPLOIT_KIT Disdain EK Flash Exploit M2 Aug 23 2017 rev 3 2024-03-14
suricata ET MALWARE Likely Evil EXE download from WinHttpRequest non-exe extension rev 4 2024-03-14
suricata ET MALWARE Drovorub shell Module Server Response rev 3 2024-03-14
suricata ET MALWARE W32/Asprox.FakeAV Affiliate Second Stage Download Location Request rev 5 2024-03-14
suricata ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server rev 3 2024-03-14
suricata ET MALWARE Win32/Spyder Successful CnC Checkin rev 2 2024-03-14
suricata ET HUNTING SUSPICIOUS Possible Office Doc with Embedded VBA Project rev 5 2024-03-14
suricata ET EXPLOIT_KIT Terror EK Payload Download M2 Mar 14 2017 rev 2 2024-03-14
suricata ET HUNTING SUSPICIOUS Possible Office Doc with Embedded VBA Project rev 5 2024-03-14
suricata ET MALWARE Win32/Stealc Requesting plugins Config from C2 rev 2 2024-03-14
suricata ET PHISHING Generic Mailbox Phishing Landing 2018-08-30 rev 2 2024-03-14
suricata ET INFO Possible SSLv2 Negotiation in Progress Client Master Key SSL2_RC2_128_CBC_EXPORT40_WITH_MD5 rev 3 2024-03-14
suricata GPL NETBIOS SMB-DS IPC$ share access rev 10 2024-03-14
suricata ET PHISHING Mailbox Revalidation Phishing Landing 2018-02-09 rev 2 2024-03-14