Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE PoshC2 - Observed Default URI Structure M23 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M27 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M18 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M17 rev 2 2022-05-06
sigma Raspberry Robin Subsequent Execution of Commands test 2022-05-06
sigma Raspberry Robin Initial Execution From External Drive test 2022-05-06
snort ET INFO [TW] Internet Computer HTTP Request Observed rev 1 2022-05-05
snort ET INFO [TW] Internet Computer HTTP Referer Observed rev 1 2022-05-05
snort ET INFO [TW] Internet Computer HTTP Location Redirect Observed rev 1 2022-05-05
snort ET INFO [TW] Internet Computer Domain Observed rev 1 2022-05-05
suricata ET PHISHING Successful Survey Credential Phish M3 2022-04-04 rev 2 2022-05-05
suricata ET PHISHING Successful Survey Credential Phish M2 2022-04-04 rev 2 2022-05-05
suricata ET PHISHING Successful Survey Credential Phish M1 2022-04-04 rev 2 2022-05-05
suricata ET HUNTING [TW] Internet Computer HTTP Referer Observed rev 1 2022-05-05
suricata ET HUNTING [TW] Internet Computer HTTP Location Redirect Observed rev 1 2022-05-05
suricata ET HUNTING [TW] Internet Computer Domain Observed rev 1 2022-05-05
suricata ET HUNTING [TW] Internet Computer HTTP Request Observed rev 1 2022-05-05
snort ET CURRENT_EVENTS Successful Survey Credential Phish M5 2022-04-04 rev 2 2022-05-04
snort ET CURRENT_EVENTS Successful Survey Credential Phish M4 2022-04-04 rev 2 2022-05-04
snort ET CURRENT_EVENTS Successful Survey Credential Phish M2 2022-04-04 rev 2 2022-05-04
snort ET CURRENT_EVENTS Successful Survey Credential Phish M6 2022-04-04 rev 2 2022-05-04
snort ET CURRENT_EVENTS Successful Survey Credential Phish M7 2022-04-04 rev 2 2022-05-04
snort ET CURRENT_EVENTS Successful Survey Credential Phish M1 2022-04-04 rev 2 2022-05-04
snort ET CURRENT_EVENTS Survey Credential Phish Landing Page 2022-04-04 rev 1 2022-05-04
snort ET CURRENT_EVENTS Successful Survey Credential Phish M3 2022-04-04 rev 2 2022-05-04
suricata ET PHISHING Successful Survey Credential Phish M4 2022-04-04 rev 2 2022-05-04
suricata ET PHISHING Survey Credential Phish Landing Page 2022-04-04 rev 1 2022-05-04
suricata ET PHISHING Successful Survey Credential Phish M5 2022-04-04 rev 1 2022-05-04
suricata ET PHISHING Successful Survey Credential Phish M6 2022-04-04 rev 2 2022-05-04
suricata ET PHISHING Successful Survey Credential Phish M7 2022-04-04 rev 2 2022-05-04
snort ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 1 rev 3 2022-05-03
snort ET TROJAN DownloaderExchanger/Cbeplay Variant Checkin rev 13 2022-05-03
snort ET TROJAN Win32/Nemty Ransomware Style Geo IP Check M2 rev 3 2022-05-03
snort ET TROJAN eCh0raix/QNAPCrypt CnC Activity - Started rev 3 2022-05-03
snort ET TROJAN Towerweb Ransomware Landing Page rev 3 2022-05-03
snort ET TROJAN Python Monero Miner CnC DNS Query rev 4 2022-05-03
snort ET TROJAN Possible DANDERSPRITZ HTTP Beacon rev 2 2022-05-03
snort ET TROJAN Win32/Xtrat.A Checkin rev 15 2022-05-03
snort ET SCAN Enumiax Inter-Asterisk Exchange Protocol Username Scan rev 6 2022-05-03
snort ET EXPLOIT Possible ECLIPSEDWING RPCTOUCH MS08-067 rev 3 2022-05-03