Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET INFO PSRC Powershell File Request rev 2 2021-03-18
snort ET INFO PSM1 Powershell File Request rev 2 2021-03-18
snort ET INFO Generic Powershell Launching Hidden Window rev 2 2021-03-18
suricata ET HUNTING Generic Powershell Launching Hidden Window rev 1 2021-03-18
suricata ET HUNTING Generic Powershell Starting Wscript Process rev 1 2021-03-18
snort ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server rev 2 2021-03-17
snort ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server rev 2 2021-03-17
snort ET SCAN DNS Query for allports.exposed rev 2 2021-03-17
suricata ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server rev 2 2021-03-17
suricata ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server rev 2 2021-03-17
elastic Execution via Regsvcs/Regasm deprecated 2021-03-17
snort ET WEB_CLIENT Leaf PHPMailer Accessed on External Server rev 2 2021-03-16
snort ET CURRENT_EVENTS Successful Wells Fargo Phish 2021-03-16 rev 2 2021-03-16
snort ET TROJAN Saint Bot CnC Activity rev 2 2021-03-16
snort ET WEB_SERVER Leaf PHPMailer Accessed on Internal Server rev 2 2021-03-16
suricata ET WEB_SERVER Leaf PHPMailer Accessed on Internal Server rev 2 2021-03-16
suricata ET WEB_CLIENT Leaf PHPMailer Accessed on External Server rev 2 2021-03-16
elastic Setgid Bit Set via chmod deprecated 2021-03-16
snort ET TROJAN Jasmin Ransomware C2 Checkin rev 2 2021-03-15
snort ET CURRENT_EVENTS OneDrive Phishing Landing 2021-03-15 rev 2 2021-03-15
suricata ET MALWARE Jasmin Ransomware C2 Checkin rev 1 2021-03-15
snort ET TROJAN PlugX/Korplug CnC Activity rev 2 2021-03-12
snort ET MALWARE Lazarus Maldoc CnC rev 2 2021-03-11
snort ET TROJAN ELF/RedXOR CnC Response rev 2 2021-03-11
snort ET TROJAN ELF/RedXOR CnC Checkin rev 2 2021-03-11
suricata ET MALWARE Lazarus Maldoc CnC rev 1 2021-03-11
snort ET CURRENT_EVENTS Generic NewInjection Phishing Landing 2021-03-10 rev 2 2021-03-10
snort ET CURRENT_EVENTS Generic Encoded Phishing Landing 2021-03-10 rev 2 2021-03-10
snort ET INFO Suspicious Glitch Hosted GET Request - Possible Phishing Landing rev 2 2021-03-10
snort ET CURRENT_EVENTS Generic Custom Logo Phishing Landing 2021-03-10 rev 2 2021-03-10
snort ET CURRENT_EVENTS Generic NewInjection Phishing Landing 2021-03-10 rev 2 2021-03-10
suricata ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing rev 1 2021-03-10
suricata ET HUNTING Suspicious Glitch Hosted GET Request - Possible Phishing Landing rev 1 2021-03-10
suricata ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing rev 1 2021-03-10
snort ET GAMES GameHouse License Check rev 2 2021-03-08
snort ET WEB_CLIENT APT/Hafnium SPORTSBALL Webshell Observed Outbound rev 2 2021-03-04
snort ET EXPLOIT ARG-W4 ASDL Router DNS Changer Exploit Attempt rev 3 2021-03-04
snort ET EXPLOIT D-Link DI-804HV DNS Changer Exploit Attempt rev 2 2021-03-04
snort ET EXPLOIT ARG-W4 ASDL Router DNS Changer Exploit Attempt M2 rev 2 2021-03-04
suricata ET EXPLOIT ARG-W4 ASDL Router DNS Changer Exploit Attempt M2 rev 2 2021-03-04