Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING JS Obfuscation - Possible Phishing 2016-03-01 rev 6 2024-03-07
suricata ET PHISHING Successful Webmail Phish M2 2016-06-22 rev 5 2024-03-07
suricata ET EXPLOIT NTDump Session Established Reg-Entry port 445 rev 8 2024-03-07
suricata ET PHISHING Apple Phishing Landing 2016-03-01 M3 rev 4 2024-03-07
suricata ET MALWARE Possible Pipka JS Skimmer - Skimmer Payload Observed M6 rev 3 2024-03-07
suricata ET PHISHING Dropbox Phishing Landing May 31 2017 rev 4 2024-03-07
suricata ET PHISHING Successful Supplier Portal Phish 2016-10-07 rev 4 2024-03-07
suricata ET INFO Base64 Encoded powershell.exe in HTTP Response M3 rev 5 2024-03-07
suricata ET MALWARE Win32/Ropest.H CnC - INBOUND rev 2 2024-03-07
suricata ET MALWARE Win32/Tofsee Unique Email Body Byte Sequence Observed rev 3 2024-03-07
suricata ET ADWARE_PUP Outerinfo.com Spyware Activity rev 11 2024-03-07
suricata ET INFO Observed ZeroSSL SSL/TLS Certificate rev 4 2024-03-07
suricata ET PHISHING Successful Generic Wembail Phish M2 2016-11-18 rev 5 2024-03-07
suricata ET PHISHING Data Submitted to Weebly.com - Possible Phishing rev 4 2024-03-07
suricata ET ADWARE_PUP Media Pass ActiveX Install rev 10 2024-03-07
suricata ET P2P ed2k file request answer rev 12 2024-03-07
suricata ET PHISHING Possible Phishing Landing via Moonfruit M1 2016-10-03 rev 4 2024-03-07
suricata ET MALWARE Steganographic Encoded WAV File Inbound via HTTP M2 rev 3 2024-03-07
suricata ET MALWARE Observed Win32/Orion Logger SMTP Exfil Subject Line rev 2 2024-03-07
suricata ET EXPLOIT Possible ETERNALCHAMPION MS17-010 Sync Response rev 6 2024-03-07
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES Server] rev 4 2024-03-07
suricata ET PHISHING Possible Chase Phishing Domain Mar 14 2016 rev 7 2024-03-07
suricata ET EXPLOIT_KIT EITest SocEng Inject Jan 15 2017 EXE Download rev 5 2024-03-07
suricata ET PHISHING Successful Poste Italiane Phish Jun 08 2017 rev 6 2024-03-07
suricata ET PHISHING PhishMe.com Phishing Exercise - Client Plugins rev 4 2024-03-07
suricata ET ADWARE_PUP yupsearch.com Spyware Install - protector.exe rev 11 2024-03-07
suricata ET EXPLOIT Possible CVE-2016-10033 PHPMailer RCE Attempt rev 4 2024-03-07
suricata ET PHISHING Possible Square Enix Phishing Domain 2016-08-15 rev 5 2024-03-07
suricata ET INFO Base64 Encoded powershell.exe in HTTP Response M1 rev 5 2024-03-07
suricata ET PHISHING Successful Gmail Phish M1 2016-08-12 rev 4 2024-03-07
suricata ET MALWARE BandarChor/CryptON Ransomware Checkin rev 3 2024-03-07
suricata ET MALWARE ELF/Emptiness v2 XOR Update Command Inbound rev 2 2024-03-07
suricata ET PHISHING Synchronize Email Account Phishing Landing 2016-07-15 rev 4 2024-03-07
suricata ET ADWARE_PUP yupsearch.com Spyware Install - sideb.exe rev 11 2024-03-07
suricata ET MALWARE FastPOS Software Update Request rev 4 2024-03-07
suricata ET EXPLOIT Pwdump3e Password Hash Retrieval port 445 rev 12 2024-03-07
suricata ET HUNTING Possible Covid19 Themed Email Spam Outbound M4 rev 3 2024-03-07
suricata ET EXPLOIT Possible ECLIPSEDWING RPCTOUCH MS08-067 rev 4 2024-03-07
suricata ET WEB_CLIENT Tech Support Phone Scam Landing Jun 29 M3 rev 5 2024-03-07
suricata ET PHISHING Targeted Office 365 Phishing Landing 2016-08-23 rev 4 2024-03-07