Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE VBS/Agent.PUK Data Exfiltration Request M1 rev 1 2022-04-13
suricata ET PHISHING Successful Sparkasse Credential Phish M2 2022-04-13 rev 2 2022-04-13
suricata ET MALWARE VBS/Agent.PUK Data Exfiltration Request M2 rev 1 2022-04-13
sigma CVE-2022-24527 Microsoft Connected Cache LPE test 2022-04-13
snort ET TROJAN Win32/TrojanDownloader.Agent.GEM Maldoc Remote Template Request M2 rev 2 2022-04-12
suricata ET MALWARE Win32/TrojanDownloader.Agent.GEM Maldoc Remote Template Request M2 rev 2 2022-04-12
sigma Suspicious Hyper-V Cmdlets test 2022-04-09
snort ET TROJAN Havex RAT CnC Server Response HTML Tag rev 4 2022-04-08
snort ET TROJAN Win32/Farfli.CUY KeepAlive M2 rev 2 2022-04-08
snort ET TROJAN Win32/Farfli.CUY CnC Server Response rev 1 2022-04-08
suricata ET MALWARE Win32/Farfli.CUY KeepAlive M2 rev 2 2022-04-08
suricata ET MALWARE Win32/Farfli.CUY CnC Server Response rev 2 2022-04-08
snort ET INFO Ordns DNS Over HTTPS Certificate Inbound rev 1 2022-04-07
suricata ET INFO Ordns DNS Over HTTPS Certificate Inbound rev 2 2022-04-07
snort ET INFO [TW] Likely Hex Executable String rev 1 2022-04-06
snort ET CURRENT_EVENTS Suspicious Form with Action Value Equal to bit .ly rev 1 2022-04-06
snort ET TROJAN Android Infostealer CnC Check-In rev 1 2022-04-06
suricata ET PHISHING Suspicious Form with Action Value Equal to bit .ly rev 2 2022-04-06
suricata ET MALWARE Android Infostealer CnC Check-In rev 1 2022-04-06
sigma Outgoing Logon with New Credentials test 2022-04-06
sigma Node Process Executions test 2022-04-06
snort ET TROJAN Win32/Agent.USB Variant CnC Activity rev 2 2022-04-05
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page M1 2022-04-05 rev 2 2022-04-05
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page M3 2022-04-05 rev 1 2022-04-05
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page M2 2022-04-05 rev 1 2022-04-05
suricata ET PHISHING Generic Credential Phish Landing Page M3 2022-04-05 rev 2 2022-04-05
suricata ET MALWARE Win32/Agent.USB Variant CnC Activity rev 1 2022-04-05
suricata ET PHISHING Generic Credential Phish Landing Page M2 2022-04-05 rev 2 2022-04-05
suricata ET PHISHING Generic Credential Phish Landing Page M1 2022-04-05 rev 2 2022-04-05
snort ET MALWARE Carder Card Checking Tool try2check.me SSL Certificate rev 4 2022-04-04
sigma Suspicious PowerShell Get Current User test 2022-04-04
sigma Suspicious GetTypeFromCLSID ShellExecute test 2022-04-02
snort ET MALWARE Deep Panda CnC Check-In rev 1 2022-04-01
snort ET CURRENT_EVENTS Generic Credential Phish Redirection 2022-03-14 rev 3 2022-04-01
suricata ET MALWARE Deep Panda CnC Check-In rev 1 2022-04-01
snort ET CURRENT_EVENTS Successful Generic Social Media Credential Phish 2022-03-31 rev 2 2022-03-31
snort ET TROJAN Suspicious Long NULL DNS Request - Possible DNS Tunneling rev 3 2022-03-31
snort ET TROJAN MSIL/Lightning Stealer Exfil Activity rev 2 2022-03-31
snort ET INFO Terse Request to note .youdao .com - Possible Download rev 2 2022-03-31
suricata ET PHISHING Successful Generic Social Media Credential Phish 2022-03-31 rev 2 2022-03-31