Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET EXPLOIT Pwdump3e Session Established Reg-Entry port 445 rev 9 2024-03-07
suricata ET PHISHING Successful Docusign Phish M1 2016-08-17 rev 4 2024-03-07
suricata ET EXPLOIT AVTECH Authenticated Command Injection in adcommand.cgi rev 3 2024-03-07
suricata ET EXPLOIT TP-Link Archer C2 and Archer C20i Remote Code Execution rev 4 2024-03-07
suricata ET INFO localtunnel Sucessful Connection Setup rev 3 2024-03-07
suricata ET INFO HTTP Request to a *.eu.tf domain rev 6 2024-03-07
suricata ET PHISHING Possible Bank of America Phishing Domain Aug 15 2016 rev 6 2024-03-07
suricata ET PHISHING Lets Encrypt Free SSL Cert Observed with IDN/Punycode Domain - Possible Phishing rev 5 2024-03-07
suricata ET EXPLOIT Possible ETERNALBLUE Exploit M3 MS17-010 rev 4 2024-03-07
suricata ET PHISHING USPS Phishing Landing 2016-02-10 rev 4 2024-03-07
suricata ET EXPLOIT ETERNALBLUE Probe Vulnerable System Response MS17-010 rev 4 2024-03-07
suricata ET PHISHING Possible Phishing Blockchain title over non SSL Jul 10 2017 rev 4 2024-03-07
suricata ET PHISHING Adobe Shared Document Phishing Landing 2016-08-30 rev 4 2024-03-07
suricata ET PHISHING Shared Document Base64 Phishing Landing 2016-01-20 rev 6 2024-03-07
suricata ET MALWARE Shamoon v3 64bit Propagating Internally via SMB rev 2 2024-03-07
suricata ET PHISHING Successful Chase Phish M1 2016-08-26 rev 4 2024-03-07
suricata ET PHISHING Email Settings Error Phishing Landing Nov 16 2016 rev 5 2024-03-07
suricata ET EXPLOIT NTDump.exe Service Started port 445 rev 8 2024-03-07
suricata ET PHISHING Possible HMRC Phishing Domain 2016-06-08 rev 6 2024-03-07
suricata ET PHISHING Phishing Landing via Tripod.com Mar 31 M3 rev 6 2024-03-07
suricata ET PHISHING Phishing Landing via Weebly.com M2 2016-02-02 rev 6 2024-03-07
suricata ET EXPLOIT_KIT Obfuscated LordEK Landing M2 rev 3 2024-03-07
suricata ET MALWARE ELF/Emptiness v2 XOR Exec Command Inbound rev 2 2024-03-07
suricata ET PHISHING Possible Amazon Phishing Domain 2016-06-21 rev 7 2024-03-07
suricata ET PHISHING Possible Phishing Landing via MoonFruit.com M3 2016-01-22 rev 5 2024-03-07
suricata ET PHISHING Successful OWA Phish Apr 25 2017 rev 4 2024-03-07
suricata ET ADWARE_PUP Media Pass ActiveX Install rev 10 2024-03-07
suricata ET MALWARE Possible Pipka JS Skimmer - Skimmer Payload Observed M1 rev 3 2024-03-07
suricata ET MALWARE IcedID CnC Domain in SNI rev 2 2024-03-07
suricata ET P2P Morpheus Install ini Download rev 12 2024-03-07
suricata ET MALWARE FIN6 StealerOne CnC Domain in SNI rev 4 2024-03-07
suricata ET MALWARE PLATINUM Steganographic HTTP Response Page Inbound rev 4 2024-03-07
suricata ET PHISHING Generic NewInjection Phishing Landing 2021-03-10 rev 3 2024-03-07
suricata ET PHISHING Successful Outlook Phish 2016-07-14 rev 5 2024-03-07
suricata ET MALWARE Win32/Parite.B Checkin 3 rev 3 2024-03-07
suricata ET PHISHING [eSentire] Successful Personalized Phish 2018-06-15 rev 3 2024-03-07
suricata ET MALWARE Possible OceanLotus CnC Heartbeat rev 2 2024-03-07
suricata ET PHISHING Successful Fedex/DHL Phish 2018-10-22 rev 4 2024-03-07
suricata ET PHISHING Successful Chase Phish M3 2016-08-26 rev 4 2024-03-07
suricata ET PHISHING Possible Phishing Landing via Moonfruit M2 2016-10-03 rev 4 2024-03-07