Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE HVNC BOT Detected rev 4 2022-03-24
suricata ET PHISHING Request for Possible Office Phishing Hosted on Github.io rev 5 2022-03-24
suricata ET PHISHING Request for Possible Docusign Phishing Hosted on Github.io rev 4 2022-03-24
suricata ET EXPLOIT TOTOLINK Router DNS Changer Exploit Attempt rev 4 2022-03-24
suricata ET EXPLOIT DSLink 260E Router DNS Changer Exploit Attempt rev 8 2022-03-24
suricata ET MALWARE Win32/Retadup CnC Checkin M2 rev 4 2022-03-24
suricata ET MALWARE Tick Group Payload - Submitting Encrypted Data to CnC rev 2 2022-03-24
suricata ET PHISHING Request for Possible Webmail Phishing Hosted on Github.io rev 4 2022-03-24
suricata ET MALWARE Tick Group Payload - Reporting Error to CnC rev 2 2022-03-24
suricata ET MALWARE HVNC USR Init Detected rev 3 2022-03-24
suricata ET PHISHING Request for Possible Binance Phishing Hosted on Github.io rev 4 2022-03-24
suricata ET EXPLOIT D-Link Router DNS Changer Exploit Attempt rev 4 2022-03-24
suricata ET MALWARE RedControle Communicating with CnC rev 4 2022-03-24
sigma Wannacry Killswitch Domain test 2022-03-24
sigma Service Installation with Suspicious Folder Pattern test 2022-03-24
sigma Multifactor Authentication Denied test 2022-03-24
snort ET POLICY Remote Access - RView - SSL Certificate Seen rev 2 2022-03-23
snort ET TROJAN Send-Safe Bulk Mailer SSL Cert - Observed in Spam Campaigns rev 2 2022-03-23
snort ET POLICY DropBox User Content Access over SSL rev 7 2022-03-23
snort ET TROJAN Spora Ransomware SSL Certificate Detected rev 2 2022-03-23
suricata ET INFO Remote Access - RView - SSL Certificate Seen rev 3 2022-03-23
suricata ET MALWARE Spora Ransomware SSL Certificate Detected rev 3 2022-03-23
suricata ET INFO DropBox User Content Access over SSL rev 7 2022-03-23
snort ET MALWARE AllaKore RAT Set Keep-Alive Observed rev 2 2022-03-22
snort ET TROJAN SUR SSL Cert APT1 rev 5 2022-03-22
snort ET TROJAN SWORD Sending Sword Marker rev 3 2022-03-22
snort ET MALWARE AllaKore RAT ID Command Observed rev 2 2022-03-22
suricata ET MALWARE AllaKore RAT ID Command Observed rev 2 2022-03-22
suricata ET MALWARE AllaKore RAT Set Keep-Alive Observed rev 2 2022-03-22
suricata ET MALWARE SUR SSL Cert APT1 rev 5 2022-03-22
suricata ET MALWARE AllaKore RAT CnC Checkin M1 rev 2 2022-03-22
suricata ET MALWARE SWORD Sending Sword Marker rev 3 2022-03-22
snort ET TROJAN Fake Virtually SSL Cert APT1 rev 4 2022-03-21
snort ET TROJAN LAME SSL Cert APT1 rev 4 2022-03-21
snort ET INFO Possible Fake Edu Host with __test Cookie rev 2 2022-03-21
snort ET TROJAN EMAIL SSL Cert APT1 rev 4 2022-03-21
snort ET TROJAN FAKE AOL SSL Cert APT1 rev 4 2022-03-21
snort ET TROJAN NS SSL Cert APT1 rev 4 2022-03-21
snort ET TROJAN FAKE YAHOO SSL Cert APT1 rev 4 2022-03-21
suricata ET MALWARE FAKE YAHOO SSL Cert APT1 rev 4 2022-03-21