Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET WEB_SERVER Generic WSO Webshell Accessed on Internal Compromised Server rev 2 2020-04-10
snort ET WEB_SERVER MINI MO Webshell Accessed on Internal Compromised Server rev 2 2020-04-10
snort ET WEB_CLIENT WSO 2.5 Webshell Accessed on External Compromised Server rev 2 2020-04-10
snort ET WEB_CLIENT WSO 2.6 Webshell Accessed on External Compromised Server rev 2 2020-04-10
snort ET CURRENT_EVENTS OneDrive Phishing Landing 2020-04-10 rev 2 2020-04-10
snort ET WEB_SERVER Kageyama Webshell Accessed on Internal Compromised Server rev 2 2020-04-10
snort ET WEB_CLIENT Kageyama Webshell Accessed on External Compromised Server rev 2 2020-04-10
snort ET WEB_CLIENT X-Sec Webshell Accessed on External Compromised Server rev 2 2020-04-10
snort ET WEB_CLIENT Generic WSO Webshell Accessed on External Compromised Server rev 2 2020-04-10
suricata ET WEB_SERVER Generic WSO Webshell Accessed on Internal Compromised Server rev 2 2020-04-10
suricata ET WEB_SERVER Kageyama Webshell Accessed on Internal Compromised Server rev 2 2020-04-10
suricata ET WEB_CLIENT WSO 2.5 Webshell Accessed on External Compromised Server rev 2 2020-04-10
suricata ET WEB_CLIENT Tech Support Scam 2020-04-10 rev 2 2020-04-10
suricata ET WEB_CLIENT WSO 4.2.5 Webshell Accessed on External Compromised Server rev 2 2020-04-10
suricata ET WEB_CLIENT MINI MO Webshell Accessed on External Compromised Server rev 2 2020-04-10
suricata ET WEB_SERVER MINI MO Webshell Accessed on Internal Compromised Server rev 2 2020-04-10
suricata ET WEB_CLIENT Kageyama Webshell Accessed on External Compromised Server rev 2 2020-04-10
suricata ET WEB_SERVER WSO 2.6 Webshell Accessed on Internal Compromised Server rev 2 2020-04-10
suricata ET WEB_SERVER WSO 2.5 Webshell Accessed on Internal Compromised Server rev 2 2020-04-10
suricata ET WEB_CLIENT X-Sec Webshell Accessed on External Compromised Server rev 2 2020-04-10
suricata ET WEB_SERVER WSO 4.2.6 Webshell Accessed on Internal Compromised Server rev 2 2020-04-10
suricata ET WEB_SERVER WSO 4.2.5 Webshell Accessed on Internal Compromised Server rev 2 2020-04-10
suricata ET WEB_CLIENT Generic WSO Webshell Accessed on External Compromised Server rev 2 2020-04-10
suricata ET WEB_SERVER X-Sec Webshell Accessed on Internal Compromised Server rev 2 2020-04-10
suricata ET WEB_CLIENT WSO 4.2.6 Webshell Accessed on External Compromised Server rev 2 2020-04-10
suricata ET PHISHING Instagram Phishing Landing 2020-04-10 rev 2 2020-04-10
suricata ET PHISHING OneDrive Phishing Landing 2020-04-10 rev 2 2020-04-10
snort ET TROJAN Possible Kimsuky APT Connectivity Check via Document rev 2 2020-04-09
snort ET INFO Request for EXE via WinHTTP M3 rev 2 2020-04-09
snort ET INFO Request for EXE via WinHTTP M2 rev 2 2020-04-09
snort ET TROJAN Lemon_Duck Powershell - Install Tracking rev 4 2020-04-09
snort ET TROJAN Lemon_Duck Powershell CnC Checkin M2 rev 2 2020-04-09
snort ET TROJAN MSIL/Agent.TRM Task Command rev 2 2020-04-09
snort ET TROJAN MSIL/Agent.TRM Checkin Response rev 2 2020-04-09
snort ET TROJAN Win32/RocketX Stealer CnC Exfil rev 2 2020-04-09
suricata ET MALWARE MSIL/Agent.TRM Checkin Response rev 1 2020-04-09
snort ET INFO Dotted Quad Host VBS Request rev 3 2020-04-08
snort ET INFO Dotted Quad Host GZ Request rev 3 2020-04-08
snort ET TROJAN Sorano Stealer CnC Checkin rev 4 2020-04-08
snort ET TROJAN Win32/TinyNuke CnC Checkin rev 9 2020-04-08