Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET ATTACK_RESPONSE Possible PowerShell AMSI Bypass Inbound rev 1 2022-11-04
suricata ET MALWARE Hyperion Obfuscator Payload Inbound rev 1 2022-11-04
suricata ET PHISHING Twitter Credential Phish Landing Page 2022-11-04 rev 1 2022-11-04
suricata ET MALWARE Win32/DataStealer.P CnC Checkin rev 1 2022-11-04
suricata ET PHISHING Successful Nordea Netbank Credential Phish 2022-11-04 rev 1 2022-11-04
suricata ET MALWARE Win32/Delf.UUW CnC Keep-Alive rev 1 2022-11-04
snort ET TROJAN Win32/FlyStudio.OJJ CnC Checkin rev 1 2022-11-03
snort ET TROJAN EICAR File Sent With X-Powered By Kaspersky Labs 2022-11-03 rev 1 2022-11-03
suricata ET MALWARE Win32/FlyStudio.OJJ CnC Checkin rev 1 2022-11-03
sigma Communication To Ngrok Tunneling Service - Linux test 2022-11-03
sigma Shadow Copies Deletion Using Operating Systems Utilities stable 2022-11-03
snort ET CURRENT_EVENTS TMOBILE Successful Credential Phish 2022-11-01 rev 1 2022-11-01
snort ET TROJAN Win32/Agent.AETZ CnC Checkin rev 1 2022-11-01
snort ET MALWARE DriverFinder User-Agent Observed in HTTP Traffic rev 1 2022-11-01
snort ET CURRENT_EVENTS TMOBILE Credential Phish Landing Page 2022-11-01 rev 1 2022-11-01
suricata ET ADWARE_PUP DriverFinder User-Agent Observed in HTTP Traffic rev 1 2022-11-01
suricata ET MALWARE Win32/Agent.AETZ CnC Checkin rev 1 2022-11-01
suricata ET PHISHING TMOBILE Credential Phish Landing Page 2022-11-01 rev 1 2022-11-01
sigma Kavremover Dropped Binary LOLBIN Usage test 2022-11-01
snort ET CURRENT_EVENTS Successful RBFCU Credential Phish 2022-10-31 rev 1 2022-10-31
snort ET INFO GET Request Exfiltrating Username and Hostname rev 1 2022-10-31
snort ET TROJAN Win32.Agent.OSCF CnC Checkin rev 1 2022-10-31
suricata ET MALWARE Win32.Agent.OSCF CnC Checkin rev 1 2022-10-31
suricata ET INFO GET Request Exfiltrating Username and Hostname rev 1 2022-10-31
suricata ET PHISHING Successful RBFCU Credential Phish 2022-10-31 rev 1 2022-10-31
sigma Suspicious Regsvr32 Execution From Remote Share test 2022-10-31
sigma Suspicious Scheduled Task Name As GUID test 2022-10-31
sigma Remote Utilities Host Service Install test 2022-10-31
sigma Suspicious User Agent test 2022-10-31
sigma NetSupport Manager Service Install test 2022-10-31
sigma CobaltStrike Named Pipe test 2022-10-31
sigma Suspicious Vsls-Agent Command With AgentExtensionPath Load test 2022-10-30
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-10-28 rev 1 2022-10-28
snort ET MOBILE_MALWARE Trojan-Dropper.AndroidOS.Guerrilla.h CnC Domain in DNS Lookup rev 1 2022-10-28
suricata ET PHISHING Generic Credential Phish Landing Page 2022-10-28 rev 1 2022-10-28
snort ET CURRENT_EVENTS America First CU Account Recovery 2022-10-27 rev 2 2022-10-27
snort ET CURRENT_EVENTS America First CU Successful Phish 2022-10-27 rev 2 2022-10-27
suricata ET PHISHING America First CU Account Recovery 2022-10-27 rev 2 2022-10-27
suricata ET PHISHING America First CU Successful Phish 2022-10-27 rev 2 2022-10-27
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-10-26 rev 1 2022-10-26