Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET EXPLOIT Pwdump3e pwservice.exe Access port 139 rev 9 2024-03-07
suricata ET ADWARE_PUP Gator/Claria Data Submission rev 18 2024-03-07
suricata ET PHISHING Possible Ebay Phishing Domain Jan 30 2017 rev 5 2024-03-07
suricata ET ATTACK_RESPONSE Windows SCM DLL Hijack Command Inbound via HTTP M1 rev 4 2024-03-07
suricata ET EXPLOIT AVTECH Unauthenticated Command Injection in DVR Devices rev 3 2024-03-07
suricata ET PHISHING Apple Phishing Landing 2016-03-01 M2 rev 6 2024-03-07
suricata ET INFO Logmein.com/Join.me SSL Remote Control Access rev 5 2024-03-07
suricata ET ADWARE_PUP 180solutions Spyware Keywords Download rev 13 2024-03-07
suricata ET PHISHING Possible Bank of America Phishing Domain Aug 15 2016 rev 6 2024-03-07
suricata ET MALWARE Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v1 ASCII rev 2 2024-03-07
suricata ET PHISHING Shared Document Base64 Phishing Landing 2016-01-20 rev 6 2024-03-07
suricata ET MALWARE Bitter RAT TCP CnC Beacon rev 2 2024-03-07
suricata ET MALWARE IcedID CnC Domain in SNI rev 2 2024-03-07
suricata ET PHISHING Yahoo Password Strength Phishing Landing 2016-08-24 rev 4 2024-03-07
suricata ET ADWARE_PUP Websearch.com Spyware rev 13 2024-03-07
suricata ET EXPLOIT D-Link 850L Password Extract Attempt rev 4 2024-03-07
suricata ET EXPLOIT Pwdump3e Password Hash Retrieval port 139 rev 11 2024-03-07
suricata ET PHISHING Successful Google Credential Phish 2016-02-17 rev 6 2024-03-07
suricata ET ADWARE_PUP Clickspring.net Spyware Reporting Successful Install rev 11 2024-03-07
suricata ET PHISHING [eSentire] Successful Personalized Phish 2018-06-15 rev 3 2024-03-07
suricata ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt rev 7 2024-03-07
suricata ET HUNTING EXE Base64 Encoded potential malware rev 3 2024-03-07
suricata ET ADWARE_PUP E2give Related Downloading Code rev 12 2024-03-07
suricata ET PHISHING Wells Fargo Mobile Phishing Landing 2016-08-01 rev 4 2024-03-07
suricata ET PHISHING Email Termination Phishing Landing 2016-06-22 rev 4 2024-03-07
suricata ET PHISHING Successful Generic Redeye Phish 2020-07-24 rev 3 2024-03-07
suricata ET PHISHING Successful Facebook Phish 2016-09-02 rev 4 2024-03-07
suricata ET PHISHING Successful Paypal Account Phish 2015-10-30 3 rev 4 2024-03-07
suricata ET EXPLOIT NTDump Session Established Reg-Entry port 139 rev 9 2024-03-07
suricata ET WEB_SPECIFIC_APPS PHPNuke general SQL injection attempt rev 13 2024-03-07
suricata ET MALWARE x0Proto File Info Request rev 2 2024-03-07
suricata ET PHISHING Successful NatWest Bank Phish M3 2016-10-19 rev 7 2024-03-07
suricata ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt rev 7 2024-03-07
suricata ET ATTACK_RESPONSE Windows SCM DLL Hijack Command Inbound via HTTP M2 rev 4 2024-03-07
suricata ET MALWARE ELF/Emptiness v2 XOR UDP Flood Command Inbound rev 2 2024-03-07
suricata ET PHISHING PhishMe.com Phishing Landing Exercise rev 7 2024-03-07
suricata ET PHISHING Successful Bank of Scotland Phish M1 2015-11-05 rev 5 2024-03-07
suricata ET PHISHING Successful Mailbox Upgrade Phish 2016-06-27 M1 rev 4 2024-03-07
suricata ET PHISHING IRS Phishing Landing 2016-01-15 rev 6 2024-03-07
suricata ET PHISHING Observed Possible Phishing Landing Page 2021-06-25 rev 3 2024-03-07