Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET ADWARE_PUP ABX Toolbar ActiveX Install rev 10 2024-03-07
suricata ET PHISHING Successful Poloniex Cryptocurrency Exchange Phish Aug 28 2017 rev 4 2024-03-07
suricata ET PHISHING [eSentire] Successful Personalized Phish 2018-06-15 rev 3 2024-03-07
suricata ET ATTACK_RESPONSE Windows SCM DLL Hijack Command Inbound via HTTP M3 rev 4 2024-03-07
suricata ET MALWARE x0Proto File Info Request rev 2 2024-03-07
suricata ET ATTACK_RESPONSE Windows SCM DLL Hijack Command Inbound via HTTP M2 rev 4 2024-03-07
suricata ET WEB_SPECIFIC_APPS Apache Struts java.lang inbound OGNL injection remote code execution attempt rev 3 2024-03-07
suricata ET MALWARE [PTsecurity] Adwind SSL Certificate Observed rev 4 2024-03-07
suricata ET WEB_CLIENT Possible JS Credit Card Stealer Inbound rev 3 2024-03-07
suricata ET PHISHING Successful Dropbox Phish M2 2015-12-10 rev 6 2024-03-07
suricata ET MALWARE Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v1 Unicode rev 4 2024-03-07
suricata ET ADWARE_PUP BInet Information Install Report rev 11 2024-03-07
suricata ET PHISHING Webmail Account Upgrade Phishing Landing 2016-07-15 rev 4 2024-03-07
suricata ET PHISHING Successful NatWest Bank Phish M3 2016-10-19 rev 7 2024-03-07
suricata ET PHISHING Yahoo Password Strength Phishing Landing 2016-08-24 rev 4 2024-03-07
suricata ET INFO Unconfigured nginx Access rev 5 2024-03-07
suricata ET PHISHING Suspicious Yahoo Page - Possible Phishing Landing rev 5 2024-03-07
suricata ET PHISHING Possible Linkedin Phishing Domain Dec 09 2016 rev 5 2024-03-07
suricata ET INFO HTTP Request to a *.co.be domain rev 7 2024-03-07
suricata ET PHISHING Successful XBOOMBER Paypal Phish Nov 28 2016 rev 4 2024-03-07
suricata ET SCAN Redis SSH Key Overwrite Probing rev 3 2024-03-07
suricata ET EXPLOIT OpenMRS Deserialization Vulnerability CVE-2018-19276 M2 rev 2 2024-03-07
suricata ET MALWARE OilRig QUADAGENT CnC Domain in SNI rev 4 2024-03-07
suricata ET WEB_SPECIFIC_APPS Apache Struts inbound .getClass OGNL injection remote code execution attempt rev 3 2024-03-07
suricata ET MALWARE ELF/Emptiness v2 XOR HTTP Flood Command Inbound rev 2 2024-03-07
suricata ET PHISHING Successful Apple Phishing 2016-03-01 M5 rev 4 2024-03-07
suricata ET MALWARE Murlo Trojan Checkin rev 12 2024-03-07
suricata ET MALWARE Brazilian Banker SSL Cert rev 4 2024-03-07
suricata ET PHISHING Successful Outlook Phish 2016-07-14 rev 5 2024-03-07
suricata ET PHISHING Suspicious Redirect - Possible Phishing May 25 2016 rev 8 2024-03-07
suricata ET VOIP Possible Misuse Call from MERA RTU rev 2 2024-03-07
suricata ET PHISHING Suspicious Compound Refresh - Possible Phishing Redirect 2016-06-09 rev 6 2024-03-07
suricata ET PHISHING Successful BankAustria Phish Nov 03 2017 rev 4 2024-03-07
suricata ET ADWARE_PUP Casino on Net Reporting Data rev 12 2024-03-07
suricata ET MALWARE Powershell commands sent when remote host claims to send an image rev 6 2024-03-07
suricata ET MALWARE ELF/Emptiness v2 XOR UDP Flood Command Inbound rev 2 2024-03-07
suricata ET MALWARE Possible Tunna Proxy Closing Connection rev 3 2024-03-07
suricata ET PHISHING Generic 302 Redirect to Phishing Landing rev 5 2024-03-07
suricata ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt rev 7 2024-03-07
suricata ET PHISHING Possible Successful Apple Phishing Domain Feb 02 2017 rev 5 2024-03-07