Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Adobe Shared Document Phishing Landing Nov 19 2015 rev 5 2024-03-07
suricata ET ADWARE_PUP LNKR Possible Response for LNKR js file rev 7 2024-03-07
suricata ET PHISHING Successful Mailbox Shutdown Phish M3 2016-05-16 rev 5 2024-03-07
suricata ET MALWARE Anuna PHP Backdoor Sucessful Exploit rev 4 2024-03-07
suricata ET EXPLOIT TP-Link Archer C2 and Archer C20i Remote Code Execution rev 4 2024-03-07
suricata ET PHISHING Successful Square Phish Nov 16 2015 rev 6 2024-03-07
suricata ET PHISHING Phishing Landing via Webeden.net 2016-10-13 rev 4 2024-03-07
suricata ET MALWARE Possible APT40/Dadstache Stage 2 Payload Beacon rev 3 2024-03-07
suricata ET WEB_SERVER BlackSquid JSP Webshell Outbound rev 4 2024-03-07
suricata ET PHISHING Amazon Phish Landing Jun 22 2017 rev 5 2024-03-07
suricata ET EXPLOIT Pwdump3e Session Established Reg-Entry port 445 rev 9 2024-03-07
suricata ET MOBILE_MALWARE Android Golden Rat Checkin rev 2 2024-03-07
suricata ET PHISHING Am3Refh Obfuscated Phishing Landing 2016-02-23 rev 5 2024-03-07
suricata ET HUNTING Possible Covid19 Themed Email Spam Outbound M3 rev 3 2024-03-07
suricata ET MALWARE REvil Exfil SFTP Certificate Inbound rev 2 2024-03-07
suricata ET MALWARE IcedID CnC Domain in SNI rev 2 2024-03-07
suricata ET MALWARE Dialer.Trojan Activity rev 7 2024-03-07
suricata ET MALWARE [Fireeye] Backdoor.BEACON M5 rev 3 2024-03-07
suricata ET INFO HTTP Request to a *.eu.tf domain rev 6 2024-03-07
suricata ET EXPLOIT_KIT Obfuscated LordEK Landing M2 rev 3 2024-03-07
suricata ET MALWARE Possible CryptXXX Ransomware Renaming Encrypted File SMB v1 ASCII rev 2 2024-03-07
suricata ET PHISHING Phishing Landing via Weebly.com M4 2016-02-02 rev 6 2024-03-07
suricata ET PHISHING Phishing Landing via Weebly.com M3 2016-02-02 rev 6 2024-03-07
suricata ET MALWARE Possible Pipka JS Skimmer - Skimmer Payload Observed M7 rev 3 2024-03-07
suricata ET MALWARE Linux/HiddenWasp CnC Response rev 4 2024-03-07
suricata ET EXPLOIT Possible ETERNALBLUE MS17-010 Heap Spray rev 5 2024-03-07
suricata ET PHISHING Possible Successful USAA Phishing Domain Feb 02 2017 rev 5 2024-03-07
suricata ET EXPLOIT NTDump.exe Service Started port 445 rev 8 2024-03-07
suricata ET PHISHING Successful Docusign Phish M1 2016-08-17 rev 4 2024-03-07
suricata ET PHISHING Team IPwned Phishing Landing 2016-08-24 rev 5 2024-03-07
suricata ET PHISHING Successful Adobe Shared PDF Phish 2016-12-13 rev 4 2024-03-07
suricata ET PHISHING Successful Craigslist Phish 2016-07-11 rev 7 2024-03-07
suricata ET PHISHING Possible Successful Bank of America Phishing Domain Feb 02 2017 rev 5 2024-03-07
suricata ET PHISHING Phishing Landing via Weebly.com 2016-06-22 rev 5 2024-03-07
suricata ET PHISHING Successful Generic Webmail Phish 2016-10-21 rev 4 2024-03-07
suricata ET PHISHING Possible HMRC Phishing Domain 2016-06-08 rev 6 2024-03-07
suricata ET MALWARE Shamoon v3 64bit Propagating Internally via SMB rev 2 2024-03-07
suricata ET INFO localtunnel Sucessful Connection Setup rev 3 2024-03-07
suricata ET EXPLOIT Possible Belkin N600DB Wireless Router Request Forgery Attempt rev 4 2024-03-07
suricata ET MALWARE PurpleFox EK Landing Page Domain in SNI rev 2 2024-03-07