Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Observed DNS Query to Redkeeper Ransomware Domain rev 2 2020-04-14
snort ET WEB_SERVER Leaf PHPMailer Accessed on Internal Server rev 2 2020-04-14
snort ET WEB_CLIENT Leaf PHPMailer Accessed on External Server rev 2 2020-04-14
snort ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server rev 2 2020-04-14
suricata ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server rev 2 2020-04-14
suricata ET WEB_CLIENT Leaf PHPMailer Accessed on External Server rev 2 2020-04-14
suricata ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server rev 2 2020-04-14
suricata ET WEB_SERVER Leaf PHPMailer Accessed on Internal Server rev 2 2020-04-14
suricata ET WEB_CLIENT WSO Webshell Password Prompt Accessed on External Compromised Server rev 2 2020-04-14
suricata ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server rev 2 2020-04-14
suricata ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server rev 2 2020-04-14
suricata ET WEB_SERVER WSO Webshell Password Prompt Accessed on Internal Compromised Server rev 2 2020-04-14
snort ET WEB_CLIENT Generic Mini Webshell Accessed on External Compromised Server rev 2 2020-04-13
snort ET TROJAN DDG Botnet Miner Download rev 2 2020-04-13
snort ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server rev 2 2020-04-13
snort ET WEB_CLIENT Anonymous Webshell Accessed on External Compromised Server rev 2 2020-04-13
snort ET WEB_SERVER Generic WSO Webshell Password Prompt Accessed on Internal Compromised Server rev 2 2020-04-13
snort ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server rev 2 2020-04-13
snort ET WEB_SERVER Generic Mini Webshell Accessed on Internal Compromised Server rev 2 2020-04-13
snort ET WEB_CLIENT Generic WSO Webshell Password Prompt Accessed on External Compromised Server rev 2 2020-04-13
snort ET WEB_SERVER Anonymous Webshell Accessed on Internal Compromised Server rev 2 2020-04-13
snort ET WEB_SERVER Generic WSO Webshell Password Prompt Accessed on Internal Compromised Server rev 2 2020-04-13
snort ET WEB_CLIENT Generic WSO Webshell Password Prompt Accessed on External Compromised Server rev 2 2020-04-13
suricata ET WEB_CLIENT Generic WSO Webshell Password Prompt Accessed on External Compromised Server rev 2 2020-04-13
suricata ET WEB_SERVER Anonymous Webshell Accessed on Internal Compromised Server rev 2 2020-04-13
suricata ET WEB_CLIENT Generic WSO Webshell Password Prompt Accessed on External Compromised Server rev 2 2020-04-13
suricata ET WEB_CLIENT Generic Mini Webshell Accessed on External Compromised Server rev 2 2020-04-13
suricata ET WEB_CLIENT Anonymous Webshell Accessed on External Compromised Server rev 2 2020-04-13
suricata ET WEB_SERVER Generic Mini Webshell Accessed on Internal Compromised Server rev 2 2020-04-13
snort ET CURRENT_EVENTS Instagram Phishing Landing 2020-04-10 rev 2 2020-04-10
snort ET TROJAN Possible DACLS RAT Log Collector Download rev 2 2020-04-10
snort ET WEB_SERVER WSO 4.2.5 Webshell Accessed on Internal Compromised Server rev 2 2020-04-10
snort ET WEB_CLIENT WSO 4.2.5 Webshell Accessed on External Compromised Server rev 2 2020-04-10
snort ET WEB_SERVER WSO 2.6 Webshell Accessed on Internal Compromised Server rev 2 2020-04-10
snort ET WEB_CLIENT Generic WSO Webshell Accessed on External Compromised Server rev 2 2020-04-10
snort ET WEB_SERVER Generic WSO Webshell Accessed on Internal Compromised Server rev 2 2020-04-10
snort ET WEB_CLIENT WSO 2.5 Webshell Accessed on External Compromised Server rev 2 2020-04-10
snort ET WEB_CLIENT MINI MO Webshell Accessed on External Compromised Server rev 2 2020-04-10
snort ET WEB_CLIENT WSO 2.6 Webshell Accessed on External Compromised Server rev 2 2020-04-10
snort ET WEB_CLIENT Kageyama Webshell Accessed on External Compromised Server rev 2 2020-04-10