Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Win32/HackTool.Agent.CS SMTP activity rev 1 2022-07-13
snort ET DNS Reply Sinkhole - Dr. Web rev 6 2022-07-13
snort ET CURRENT_EVENTS Successful Standard Bank Credential Phish 2022-07-12 M2 rev 1 2022-07-13
snort ET INFO GET Request to Pastebin .com with PowerShell User-Agent rev 1 2022-07-13
snort ET TROJAN DNS Reply Sinkhole - Anubis - 195.22.26.192/26 rev 6 2022-07-13
snort ET TROJAN DNS Reply Sinkhole - Microsoft - 131.253.18.11-12 rev 7 2022-07-13
snort ET TROJAN DNS Reply Sinkhole - IP - 161.69.13.44 rev 4 2022-07-13
snort ET CURRENT_EVENTS Successful Standard Bank Credential Phish 2022-07-12 M3 rev 1 2022-07-13
suricata ET MALWARE DNS Reply Sinkhole - Microsoft - 131.253.18.11-12 rev 7 2022-07-13
suricata ET MALWARE Win32/HackTool.Agent.CS SMTP activity rev 1 2022-07-13
suricata ET MALWARE DNS Reply Sinkhole - Microsoft - 199.2.137.0/24 rev 3 2022-07-13
suricata ET PHISHING Successful Standard Bank Credential Phish 2022-07-12 M2 rev 1 2022-07-13
suricata ET MALWARE DNS Reply Sinkhole - Anubis - 195.22.26.192/26 rev 6 2022-07-13
suricata ET MALWARE DNS Reply Sinkhole Microsoft NO-IP Domain rev 3 2022-07-13
suricata ET DNS Reply Sinkhole - Zinkhole.org rev 6 2022-07-13
suricata ET PHISHING Successful Standard Bank Credential Phish 2022-07-12 M3 rev 1 2022-07-13
suricata ET PHISHING Successful Standard Bank Credential Phish 2022-07-12 M1 rev 1 2022-07-13
suricata ET DNS Reply Sinkhole - Dr. Web rev 6 2022-07-13
suricata ET DNS Reply Sinkhole - sinkhole.cert.pl 148.81.111.111 rev 5 2022-07-13
suricata ET HUNTING GET Request to Pastebin .com with PowerShell User-Agent rev 1 2022-07-13
suricata ET PHISHING Successful Standard Bank Credential Phish 2022-07-12 M4 rev 1 2022-07-13
suricata ET MALWARE Win64/Agent.qwiakk CnC Checkin rev 1 2022-07-13
suricata ET MALWARE DNS Reply Sinkhole - IP - 161.69.13.44 rev 4 2022-07-13
suricata ET DNS Reply Sinkhole - 106.187.96.49 blacklistthisdomain.com rev 7 2022-07-13
sigma AD Privileged Users or Groups Reconnaissance test 2022-07-13
snort ET TROJAN X-Files Stealer CnC Exfil Activity M2 rev 1 2022-07-12
snort ET CURRENT_EVENTS Successful Microsoft Phish 2022-07-10 rev 1 2022-07-12
snort ET CURRENT_EVENTS Successful Midea Credential Phish 2022-07-12 rev 1 2022-07-12
snort ET CURRENT_EVENTS Midea Credential Phish Landing Page 2022-07-12 rev 1 2022-07-12
suricata ET MALWARE MSIL/Agent.CTK Checkin rev 1 2022-07-12
suricata ET PHISHING Successful Midea Credential Phish 2022-07-12 rev 1 2022-07-12
suricata ET PHISHING Successful Microsoft Phish 2022-07-10 rev 1 2022-07-12
suricata ET PHISHING Midea Credential Phish Landing Page 2022-07-12 rev 1 2022-07-12
sigma DNS RCE CVE-2020-1350 test 2022-07-12
sigma Failed MSExchange Transport Agent Installation test 2022-07-12
sigma LPE InstallerFileTakeOver PoC CVE-2021-41379 test 2022-07-12
sigma Base64 MZ Header In CommandLine test 2022-07-12
sigma Possible Exploitation of Exchange RCE CVE-2021-42321 test 2022-07-12
snort ET TROJAN HiveRAT CnC Activity M2 rev 1 2022-07-11
snort ET CURRENT_EVENTS Successful OWA Phish 2022-07-11 rev 1 2022-07-11