Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CURRENT_EVENTS Microsoft Account Redirect to Phishing Landing rev 2 2021-04-06
snort ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2021-04-06
snort ET CURRENT_EVENTS Generic Bank Captcha Phishing Landing rev 2 2021-04-06
snort ET CURRENT_EVENTS Generic Multibrand NewInjection Phishing Landing Template rev 2 2021-04-06
suricata ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2021-04-06
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2021-04-06
suricata ET PHISHING Generic Multibrand NewInjection Phishing Landing Template rev 2 2021-04-06
suricata ET WEB_SPECIFIC_APPS Openfire Jabber-Server type Parameter DELETE FROM SQL Injection Attempt rev 5 2021-04-06
suricata ET PHISHING Microsoft Account Redirect to Phishing Landing rev 2 2021-04-06
suricata ET PHISHING Generic Bank Captcha Phishing Landing rev 2 2021-04-06
suricata ET WEB_SPECIFIC_APPS Openfire Jabber-Server type Parameter UPDATE SET SQL Injection Attempt rev 5 2021-04-06
suricata ET PHISHING Generic Hidden Text - Possible Phishing Landing rev 2 2021-04-06
suricata ET WEB_SPECIFIC_APPS Openfire Jabber-Server type Parameter INSERT INTO SQL Injection Attempt rev 5 2021-04-06
suricata ET PHISHING Generic Bank Captcha Phishing Landing rev 2 2021-04-06
suricata ET WEB_SPECIFIC_APPS Openfire Jabber-Server type Parameter SELECT FROM SQL Injection Attempt rev 5 2021-04-06
suricata ET WEB_SPECIFIC_APPS Openfire Jabber-Server type Parameter UNION SELECT SQL Injection Attempt rev 5 2021-04-06
snort ET CURRENT_EVENTS Generic Phishing Panel Accessed on Internal Server rev 2 2021-04-05
snort ET TROJAN DonotGroup Template Download rev 2 2021-04-05
snort ET CURRENT_EVENTS Generic Phishing Panel Accessed on Internal Server rev 2 2021-04-05
snort ET CURRENT_EVENTS Suspicious GitHack TLS SNI Request - Possible PurpleFox EK rev 2 2021-04-05
snort ET TROJAN Win32/MereTam.A Ransomware CnC Checkin rev 2 2021-04-05
snort ET CURRENT_EVENTS Suspicious GitHack DNS Request - Possible PurpleFox EK rev 2 2021-04-05
snort ET CURRENT_EVENTS Generic Phishing Panel Accessed on External Server rev 2 2021-04-05
snort ET INFO Killbot JS Configuration - Possible Phishing rev 2 2021-04-05
snort ET TROJAN Win32/MereTam.A Ransomware CnC Init Activity rev 2 2021-04-05
snort ET CURRENT_EVENTS Generic Phishing Panel Accessed on External Server rev 2 2021-04-05
suricata ET PHISHING Generic Phishing Panel Accessed on External Server rev 2 2021-04-05
suricata ET PHISHING Generic Phishing Panel Accessed on Internal Server rev 2 2021-04-05
suricata ET PHISHING Generic Phishing Panel Accessed on Internal Server rev 2 2021-04-05
suricata ET PHISHING Generic Phishing Panel Accessed on External Server rev 2 2021-04-05
suricata ET INFO Killbot JS Configuration - Possible Phishing rev 2 2021-04-05
suricata ET EXPLOIT_KIT Suspicious GitHack DNS Request - Possible PurpleFox EK rev 2 2021-04-05
snort ET MALWARE DriverPack Domain in DNS Query rev 2 2021-04-01
snort ET TROJAN WebMonitor/RevCode RAT CnC Domain in DNS Lookup rev 2 2021-04-01
snort ET INFO Terse Request for EXE from DigitalOcean Spaces rev 2 2021-04-01
suricata ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup rev 1 2021-04-01
suricata ET ADWARE_PUP DriverPack Domain in DNS Query rev 2 2021-04-01
snort ET TROJAN Ousaban Related Maldoc Activity rev 2 2021-03-31
snort ET INFO Request for EXE via GO HTTP Client rev 2 2021-03-31
suricata ET INFO Request for EXE via GO HTTP Client rev 1 2021-03-31