Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET INFO python.urllib User Agent Web Crawl rev 12 2024-03-11
suricata ET MALWARE Win32/CryptFile2 Ransomware Checkin M2 rev 5 2024-03-11
suricata ET MALWARE Fake Opera 8.11 UA related to Trojan Activity rev 5 2024-03-11
suricata ET MALWARE [ANY.RUN] Xeno-RAT TCP Check-In rev 3 2024-03-11
sigma Failed Logon From Public IP test 2024-03-11
sigma External Remote RDP Logon from Public IP test 2024-03-11
sigma Remote Access Tool - Team Viewer Session Started On MacOS Host test 2024-03-11
sigma External Remote SMB Logon from Public IP test 2024-03-11
sigma Remote Access Tool - Team Viewer Session Started On Linux Host test 2024-03-11
sigma Remote Access Tool - Team Viewer Session Started On Windows Host test 2024-03-11
sigma Renamed NirCmd.EXE Execution test 2024-03-11
suricata ET MALWARE Umbra/MultiBot Plugin access rev 5 2024-03-10
suricata ET MALWARE EtumBot Registration Request rev 8 2024-03-10
suricata ET INFO Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile rev 9 2024-03-10
suricata ET MALWARE Fake/Short Google Search Appliance UA Win32/Ranbyus and Others rev 5 2024-03-10
suricata ET MALWARE Likely Infected HTTP POST to PHP with User-Agent of HTTP Client rev 5 2024-03-10
suricata ET INFO SUSPICIOUS UA starting with Mozilla/0 rev 4 2024-03-10
suricata ET MALWARE W32/Armageddon CnC Checkin rev 4 2024-03-10
suricata ET SCAN Absinthe SQL Injection Tool HTTP Header Detected rev 9 2024-03-10
suricata ET WEB_SERVER AntSword Webshell Commands Inbound rev 3 2024-03-10
suricata ET MALWARE Likseput.B Checkin rev 6 2024-03-10
suricata ET MALWARE FrauDrop UA LETITGO rev 4 2024-03-10
suricata ET MALWARE W32/ServStart.Variant CnC Beacon rev 4 2024-03-10
suricata ET MALWARE FakeAV Win32/Antivirus2008 CnC Beacon rev 10 2024-03-10
suricata ET SCAN ZmEu Scanner User-Agent Inbound rev 5 2024-03-10
suricata ET INFO Outbound HTTP Connection From Cisco IOS Device rev 5 2024-03-10
suricata ET MALWARE AntSword Webshell User-Agent Observed rev 3 2024-03-10
suricata ET MALWARE Observed Win32/CollectorStealer User-Agent M1 rev 2 2024-03-10
suricata ET INFO VMware User-Agent Outbound rev 7 2024-03-10
suricata ET MALWARE Observed Win32/CollectorStealer User-Agent M2 rev 3 2024-03-10
suricata ET MALWARE W32/Badur.Spy User Agent lawl rev 6 2024-03-10
suricata ET MALWARE FrauDrop UA single rev 4 2024-03-10
suricata ET MALWARE Hoax.Win32.BadJoke/DownLoader1.57593 Checkin rev 5 2024-03-10
snort ET TROJAN TA399/SideWinder Related Backdoor Activity rev 1 2024-03-08
snort ET TROJAN Magnet Goblin Linux Nerbian RAT Trigger Sequence from CnC Server rev 1 2024-03-08
suricata GPL NETBIOS SMB startup folder unicode access rev 6 2024-03-08
suricata GPL RPC portmap network-status-monitor request TCP rev 8 2024-03-08
suricata ET MOBILE_MALWARE PJobRat System Exfil to CnC rev 2 2024-03-08
suricata GPL ATTACK_RESPONSE del attempt rev 10 2024-03-08
suricata GPL EXPLOIT cmd32.exe access rev 6 2024-03-08