Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE PurpleFox EK Landing Page Domain in SNI rev 2 2024-03-07
suricata ET PHISHING Shared Document Base64 Phishing Landing 2016-01-20 rev 6 2024-03-07
suricata ET EXPLOIT Possible Oracle Identity Manager Attempt to Logon with default account rev 5 2024-03-07
suricata ET PHISHING Am3Refh Obfuscated Phishing Landing 2016-02-23 rev 5 2024-03-07
suricata ET ATTACK_RESPONSE Windows SCM DLL Hijack Command Inbound via HTTP M1 rev 4 2024-03-07
suricata ET EXPLOIT_KIT Obfuscated LordEK Landing M2 rev 3 2024-03-07
suricata ET MALWARE Linux/HiddenWasp CnC Response rev 4 2024-03-07
suricata ET ADWARE_PUP LNKR Possible Response for LNKR js file rev 7 2024-03-07
suricata ET PHISHING Possible Bank of America Phishing Domain Aug 15 2016 rev 6 2024-03-07
suricata ET EXPLOIT Pwdump3e Session Established Reg-Entry port 445 rev 9 2024-03-07
suricata ET PHISHING Successful HM Revenue Phish 2016-11-23 rev 4 2024-03-07
suricata ET PHISHING Phishing Landing via Webeden.net 2016-10-13 rev 4 2024-03-07
suricata ET PHISHING Successful Paypal Phish M2 2016-09-29 rev 6 2024-03-07
suricata ET VOIP H.323 in Q.931 Call Setup - Inbound rev 2 2024-03-07
suricata ET EXPLOIT ETERNALBLUE Probe Vulnerable System Response MS17-010 rev 4 2024-03-07
suricata ET PHISHING Possible HMRC Phishing Domain 2016-06-08 rev 6 2024-03-07
suricata ET PHISHING Team IPwned Phishing Landing 2016-08-24 rev 5 2024-03-07
suricata ET MALWARE REvil Exfil SFTP Certificate Inbound rev 2 2024-03-07
suricata ET PHISHING Possible Phishing Landing via MoonFruit.com M1 2016-01-22 rev 6 2024-03-07
suricata ET MALWARE Shamoon v3 64bit Propagating Internally via SMB rev 2 2024-03-07
suricata ET MALWARE CobianRAT Screenshot Exfil to CnC rev 3 2024-03-07
suricata ET MALWARE Possible APT40/Dadstache Stage 2 Payload Beacon rev 3 2024-03-07
suricata ET WEB_CLIENT JS ShellWindows/AddInProcess Win10 DeviceGuardBypass Inbound rev 3 2024-03-07
suricata ET EXPLOIT Apache Struts memberAccess and getWriter inbound OGNL injection remote code execution attempt rev 4 2024-03-07
suricata ET PHISHING Adobe Shared Document Phishing Landing Nov 19 2015 rev 5 2024-03-07
suricata ET EXPLOIT Possible ETERNALBLUE Exploit M3 MS17-010 rev 4 2024-03-07
suricata ET MALWARE Possible CryptXXX Ransomware Renaming Encrypted File SMB v1 ASCII rev 2 2024-03-07
suricata ET EXPLOIT TP-Link Archer C2 and Archer C20i Remote Code Execution rev 4 2024-03-07
suricata ET MALWARE Win32/Tofsee Pharma Spam Template Active - Outbound Email Spam rev 2 2024-03-07
suricata ET MALWARE IcedID CnC Domain in SNI rev 2 2024-03-07
suricata ET WEB_SERVER WeBaCoo Web Backdoor Detected rev 6 2024-03-07
suricata ET HUNTING Possible Covid19 Themed Email Spam Outbound M3 rev 3 2024-03-07
suricata ET MALWARE HTML/Xbash Hex Encoded PS WebClient Object Inbound - Stage 1 rev 3 2024-03-07
suricata ET PHISHING Blocked Email Account Phishing Landing 2016-08-23 rev 4 2024-03-07
suricata ET PHISHING Successful Apple Phish 2016-03-09 rev 5 2024-03-07
suricata ET ADWARE_PUP Clickspring.net Spyware Reporting rev 11 2024-03-07
suricata ET PHISHING Successful Mailbox Shutdown Phish M3 2016-05-16 rev 5 2024-03-07
suricata ET EXPLOIT Possible Belkin N600DB Wireless Router Request Forgery Attempt rev 4 2024-03-07
suricata ET PHISHING Successful Webmail Validator Phish M2 2016-09-02 rev 4 2024-03-07
suricata ET PHISHING Phishing Landing via Weebly.com M4 2016-02-02 rev 6 2024-03-07