Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma New Kind of Network (NKN) Detection test 2022-04-21
sigma DLL Load via LSASS test 2022-04-21
sigma Explorer NOUACCHECK Flag test 2022-04-21
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded WebUI Login Attempt M2 rev 2 2022-04-20
snort ET TROJAN Win32/TrojanDownloader.Agent.RFS Variant Checkin rev 2 2022-04-20
sigma Suspicious Dropbox API Usage test 2022-04-20
snort ET SCAN RDP Connection Attempt from Nmap rev 1 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded WebUI Login Attempt M1 rev 2 2022-04-19
snort ET MALWARE Win/Malware.FileTour Variant Checkin rev 1 2022-04-19
snort ET TROJAN Zingo/GinzoStealer Data Exfiltration M2 rev 2 2022-04-19
snort ET TROJAN Zingo/GinzoStealer Downloading Additional Payloads rev 2 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC ConfigSyncProc RCE Attempt rev 1 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Stack Overflow in Base64 Authorization Mechanism M1 rev 2 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded Credential ConfigSyncProc System Details Request rev 2 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Stack Overflow in Base64 Authorization Mechanism M2 rev 2 2022-04-19
snort ET MALWARE Win/Malware.FileTour Variant Checkin rev 1 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded Credential ConfigSyncProc Login Attempt rev 2 2022-04-19
suricata ET SCAN RDP Connection Attempt from Nmap rev 1 2022-04-19
suricata ET MALWARE Zingo/GinzoStealer Data Exfiltration M2 rev 1 2022-04-19
suricata ET ADWARE_PUP Win/Malware.FileTour Variant Checkin rev 1 2022-04-19
suricata ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Stack Overflow in Base64 Authorization Mechanism M2 rev 1 2022-04-19
suricata ET MALWARE Zingo/GinzoStealer Downloading Additional Payloads rev 2 2022-04-19
snort ET CURRENT_EVENTS TodayZoo Phishing Kit GET M1 rev 2 2022-04-18
snort ET CURRENT_EVENTS Successful TA422 Credential Phish 2022-03-17 M1 rev 2 2022-04-18
snort ET WEB_SPECIFIC_APPS coRED CMS rubID Parameter SELECT FROM SQL Injection Attempt rev 4 2022-04-18
snort GPL NETBIOS DCERPC CoGetInstanceFromFile little endian overflow attempt rev 7 2022-04-18
snort ET SCAN struts-pwn User-Agent rev 2 2022-04-18
snort ET CURRENT_EVENTS Metawallet Phish Landing Page 2022-01-13 rev 2 2022-04-18
snort ET CURRENT_EVENTS Successful Monzo Credential Phish M2 2022-02-17 rev 2 2022-04-18
snort ET CURRENT_EVENTS IRS Credential Phish Credit Card Payment Data Exfil rev 2 2022-04-18
snort ET TROJAN Nuke Ransomware Checkin rev 3 2022-04-18
snort ET TROJAN Nbar.co.kr Related Trojan Checkin rev 4 2022-04-18
snort ET TROJAN MSIL/Injector.VVP Downloader Activity M1 rev 3 2022-04-18
snort ET INFO Powershell Request for paste .ee Page rev 3 2022-04-18
snort ET MALWARE Win32/MobiGame Install Stats Checkin M3 rev 3 2022-04-18
snort ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- send_password_preferences.asp UNION SELECT rev 7 2022-04-18
snort ET TROJAN Lazarus Related Maldoc Activity rev 2 2022-04-18
snort ET CURRENT_EVENTS Paypal Phishing Landing Jun 28 2017 rev 3 2022-04-18
snort ET TROJAN [PTsecurity] Win32/Remcos RAT Checkin 51 rev 2 2022-04-18
snort ET WEB_SPECIFIC_APPS Apache Struts ognl inbound OGNL injection remote code execution attempt rev 3 2022-04-18