Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CURRENT_EVENTS Successful Generic Phish 2022-08-01 rev 1 2022-08-02
snort ET MALWARE DriverPack Update Checkin rev 1 2022-08-02
snort ET TROJAN Manjusaka CnC Server Response rev 1 2022-08-02
snort ET INFO Terse Request for WordPress Site ending in all digits rev 1 2022-08-02
suricata ET HUNTING Possible COVID-19 Domain in SSL Certificate M2 rev 5 2022-08-02
suricata ET MALWARE Manjusaka CnC Server Response rev 1 2022-08-02
suricata ET PHISHING Successful Generic Phish 2022-08-01 rev 1 2022-08-02
suricata ET MALWARE Win32/Agent.TWI CnC Checkin rev 1 2022-08-02
elastic Whitespace Padding in Process Command Line deprecated 2022-08-02
elastic File and Directory Discovery deprecated 2022-08-02
elastic DNS Activity to the Internet deprecated 2022-08-02
sigma DLL Sideloading by VMware Xfer Utility test 2022-08-02
sigma Suspicious Download from Office Domain test 2022-08-02
sigma Sysmon Configuration Modification test 2022-08-02
snort ET TROJAN Win32/Small.NMZ CnC Checkin rev 1 2022-08-01
snort ET CURRENT_EVENTS Successful Commerce Bank Phish 2022-07-30 rev 1 2022-08-01
suricata ET PHISHING Successful Commerce Bank Phish 2022-07-30 rev 1 2022-08-01
elastic Potential Privilege Escalation via Local Kerberos Relay over LDAP deprecated 2022-08-01
sigma ISO File Created Within Temp Folders test 2022-07-30
sigma DLL Search Order Hijackig Via Additional Space in Path test 2022-07-30
snort ET TROJAN RKO Remote File Upload Attempt rev 1 2022-07-29
snort ET CURRENT_EVENTS [TW] EvilProxy AiTM Network Reporting rev 1 2022-07-29
snort ET CURRENT_EVENTS [TW] Robin Banks HTTP GET Struct rev 1 2022-07-29
snort ET CURRENT_EVENTS [TW] EvilProxy AiTM Username Checkin rev 1 2022-07-29
snort ET CURRENT_EVENTS [TW] Robin Banks Redirect M1 rev 1 2022-07-29
suricata ET PHISHING [TW] EvilProxy AiTM Username Checkin rev 1 2022-07-29
suricata ET PHISHING [TW] Robin Banks Redirect M1 rev 1 2022-07-29
suricata ET PHISHING [TW] Robin Banks HTTP GET Struct rev 1 2022-07-29
suricata ET MALWARE RKO Remote File Upload Attempt rev 1 2022-07-29
suricata ET PHISHING [TW] EvilProxy AiTM Network Reporting rev 1 2022-07-29
snort ET TROJAN IIS Backdoor CnC Command Inbound rev 1 2022-07-28
snort ET TROJAN W32.DarkVNC Variant Checkin rev 1 2022-07-28
snort ET TROJAN Win32/SystemHijack.gen CnC Checkin rev 1 2022-07-28
snort ET TROJAN MSIL/Filecoder.EK CnC Checkin rev 1 2022-07-28
snort ET CURRENT_EVENTS Phishing Landing Page - Excel Purchase Order Form rev 1 2022-07-28
suricata ET MALWARE W32.DarkVNC Variant Checkin rev 1 2022-07-28
elastic Strace Process Activity deprecated 2022-07-28
sigma Drop Binaries Into Spool Drivers Color Folder test 2022-07-28
sigma Suspicious Schtasks Execution AppData Folder test 2022-07-28
sigma End User Consent test 2022-07-28