Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CURRENT_EVENTS Successful Caixa Credential Phish 2022-06-29 rev 1 2022-06-29
snort ET CURRENT_EVENTS Successful Microsoft Credential Phish 2022-06-28 rev 1 2022-06-29
suricata ET PHISHING Generic Credential Phish Landing Page 2022-06-29 rev 1 2022-06-29
suricata ET PHISHING Successful Microsoft Credential Phish 2022-06-28 rev 1 2022-06-29
suricata ET MALWARE Win32/a310Logger Variant Data Exfil via SMTP rev 1 2022-06-29
suricata ET HUNTING Microsoft Office User-Agent Requesting An Excel File rev 1 2022-06-29
suricata ET HUNTING Microsoft Office User-Agent Requesting A Doc File rev 1 2022-06-29
suricata ET PHISHING Successful Caixa Credential Phish 2022-06-29 rev 1 2022-06-29
sigma Suspicious LSASS Access Via MalSecLogon test 2022-06-29
sigma Suspicious Where Execution test 2022-06-29
snort ET TROJAN Win32/Wacapew.C!ml Checkin rev 1 2022-06-28
snort ET INFO Self-Signed Cert O=XX Observed rev 4 2022-06-28
suricata ET HUNTING Self-Signed Cert O=XX Observed rev 5 2022-06-28
sigma Discovery of a System Time test 2022-06-28
sigma Sign-ins from Non-Compliant Devices test 2022-06-28
sigma Users Added to Global or Device Admin Roles test 2022-06-28
sigma Device Registration or Join Without MFA test 2022-06-28
sigma Changes to Device Registration Policy test 2022-06-28
sigma Bitlocker Key Retrieval test 2022-06-28
snort ET CURRENT_EVENTS Successful ING Group Phish 2022-06-24 rev 2 2022-06-27
snort ET USER_AGENTS Suspicious User-Agent Mozilla/3.0 rev 6 2022-06-27
snort ET TROJAN Win32/Ymacco.AA60 Checkin rev 1 2022-06-27
snort ET INFO Invalid User-Agent - MSIE 9 on Windows NT 5 rev 6 2022-06-27
suricata ET PHISHING Successful ING Group Phish 2022-06-24 rev 2 2022-06-27
suricata ET HUNTING Invalid User-Agent - MSIE 9 on Windows NT 5 rev 9 2022-06-27
sigma WerFault LSASS Process Memory Dump test 2022-06-27
sigma Suspect Svchost Activity test 2022-06-27
snort ET INFO Observed TinyNuke Admin Panel URL Pattern rev 1 2022-06-24
snort ET TROJAN Win32/Syndicasec Encoded Response Embedded in HTML Title Tags Inbound rev 3 2022-06-24
snort ET CURRENT_EVENTS Successful OWA Phish 2022-06-23 rev 1 2022-06-24
snort ET TROJAN ToddyCat Ninja Backdoor CnC rev 1 2022-06-24
suricata ET MALWARE ToddyCat Ninja Backdoor CnC rev 1 2022-06-24
suricata ET MALWARE Win32/Syndicasec Encoded Response Embedded in HTML Title Tags Inbound rev 3 2022-06-24
snort ET CURRENT_EVENTS Successful Emirates NBD Bank Credential Phish 2022-06-23 rev 1 2022-06-23
snort GPL ATTACK_RESPONSE command completed rev 13 2022-06-23
snort ET CURRENT_EVENTS Emirates NBD Bank Credential Phish Landing Page 2022-06-23 rev 1 2022-06-23
snort ET CURRENT_EVENTS Nedbank Phishing Landing Page 2022-06-22 rev 1 2022-06-23
suricata ET PHISHING Emirates NBD Bank Credential Phish Landing Page 2022-06-23 rev 1 2022-06-23
snort ET TROJAN Win32/Unknown Stealer CnC Log Exfil rev 1 2022-06-22
snort ET MOBILE_MALWARE Android Spy Hermit CnC Domain in DNS Lookup rev 1 2022-06-22