Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET MALWARE Win32/DownWare.V Checkin rev 2 2022-01-12
snort ET TROJAN Win32/Delf.TJJ Variant CnC Activity rev 2 2022-01-12
suricata ET PHISHING Adobe Phish Landing Page 2022-01-12 rev 2 2022-01-12
suricata ET ADWARE_PUP Win32/DownWare.V Checkin rev 2 2022-01-12
suricata ET PHISHING Successful Adobe Phish 2022-01-12 rev 2 2022-01-12
elastic Threat Intel Filebeat Module (v7.x) Indicator Match deprecated 2022-01-12
sigma Suspicious Scheduled Task Write to System32 Tasks test 2022-01-12
sigma Sysmon Configuration Change test 2022-01-12
sigma Create Volume Shadow Copy with Powershell test 2022-01-12
sigma File Time Attribute Change test 2022-01-12
snort ET EXPLOIT Qianxin Netcom NGFW Command Injection rev 1 2022-01-11
snort ET CURRENT_EVENTS Generic Banking Phish Landing Page 2022-01-11 rev 2 2022-01-11
snort ET TROJAN Win32/Emotet HTML Template Response rev 1 2022-01-11
snort ET CURRENT_EVENTS Successful Generic Banking Phish 2022-01-11 rev 2 2022-01-11
suricata ET MALWARE Win32/Emotet HTML Template Response rev 1 2022-01-11
suricata ET EXPLOIT Qianxin Netcom NGFW Command Injection rev 1 2022-01-11
suricata ET PHISHING Successful Generic Banking Phish 2022-01-11 rev 2 2022-01-11
suricata ET PHISHING Successful Generic Banking Phish 2022-01-11 rev 2 2022-01-11
snort ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Enumeration Activity M1 rev 1 2022-01-10
snort ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Lateral Movement Activity rev 1 2022-01-10
snort ET TROJAN PurpleFox Backdoor/Rootkit Checkin rev 1 2022-01-10
snort ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Enumeration Activity M2 rev 1 2022-01-10
snort ET TROJAN PurpleFox Backdoor/Rootkit Download Server Response M2 rev 2 2022-01-10
snort ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Command Tunneling M1 rev 1 2022-01-10
snort ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Command Tunneling M2 rev 1 2022-01-10
snort ET TROJAN Quasar CnC Domain in DNS Lookup rev 2 2022-01-10
snort ET EXPLOIT Possible ELEFANTE/ElephantBeetle WebShell Access Inbound rev 1 2022-01-10
suricata ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Command Tunneling M2 rev 1 2022-01-10
suricata ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Lateral Movement Activity rev 1 2022-01-10
suricata ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Enumeration Activity M2 rev 1 2022-01-10
suricata ET EXPLOIT Possible ELEFANTE/ElephantBeetle WebShell Access Inbound rev 1 2022-01-10
suricata ET MALWARE Quasar CnC Domain in DNS Lookup rev 1 2022-01-10
suricata ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Enumeration Activity M1 rev 1 2022-01-10
suricata ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Command Tunneling M1 rev 1 2022-01-10
suricata ET MALWARE PurpleFox Backdoor/Rootkit Checkin rev 1 2022-01-10
sigma ChromeLoader Malware Execution test 2022-01-10
snort ET WEB_CLIENT Observed JavaScript Event Listener with Clipboard Data rev 2 2022-01-07
suricata ET WEB_CLIENT Observed JavaScript Event Listener with Clipboard Data rev 2 2022-01-07
sigma Suspicious SYSVOL Domain Group Policy Access test 2022-01-07
sigma Suspicious Process Start Locations test 2022-01-07