Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET POLICY localtunnel Sucessful Connection Setup rev 2 2017-12-04
snort ET INFO HTTP POST Request to Suspicious *.gdn Domain rev 2 2017-12-03
snort ET INFO HTTP POST Request to Suspicious *.ga Domain rev 2 2017-12-03
snort ET INFO HTTP POST Request to Suspicious *.gq domain rev 2 2017-12-03
snort ET CURRENT_EVENTS Successful BankAustria Phish Nov 03 2017 rev 3 2017-12-01
snort ET TROJAN UBoatRAT CnC Check-in rev 1 2017-12-01
snort ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt rev 4 2017-11-30
snort ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt rev 3 2017-11-30
snort ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt rev 4 2017-11-30
snort ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt rev 3 2017-11-30
snort ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt rev 3 2017-11-30
snort ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt rev 3 2017-11-30
snort ET EXPLOIT Actiontec C1000A backdoor account M2 rev 3 2017-11-29
snort ET TROJAN Brazilian Banker SSL Cert rev 1 2017-11-28
snort ET EXPLOIT Netgear passwordrecovered.cgi attempt rev 3 2017-11-28
snort ET ATTACK_RESPONSE webr00t WebShell Access rev 4 2017-11-28
snort ET ATTACK_RESPONSE Linksys Router Returning Device Settings To External Source rev 2 2017-11-28
snort ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Response rev 3 2017-11-27
snort ET WEB_CLIENT Google Chrome Credential Stealing via SCF file Reflected Request rev 1 2017-11-27
snort ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 3 rev 1 2017-11-22
snort ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 2 rev 1 2017-11-22
snort ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 1 rev 1 2017-11-22
snort ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 4 rev 1 2017-11-22
snort ET CURRENT_EVENTS Possible Successful Phish to .tk domain Aug 26 2016 rev 2 2017-11-20
snort ET CURRENT_EVENTS Successful Amazon.com Phish M1 2016-06-27 rev 2 2017-11-17
snort ET CURRENT_EVENTS Possible Linkedin Phishing Domain Dec 09 2016 rev 2 2017-11-17
snort ET CURRENT_EVENTS Successful Poste Italiane Phish 2016-12-23 rev 2 2017-11-17
snort ET CURRENT_EVENTS Possible Discover Phishing Domain Feb 02 2017 rev 3 2017-11-17
snort ET TROJAN Possibly Malicious Base64 Unicode WebClient DownloadString M3 rev 2 2017-11-16
snort ET TROJAN Book of Eli CnC Checkin rev 3 2017-11-16
snort ET TROJAN Powershell commands sent B64 2 rev 1 2017-11-16
snort ET TROJAN Possibly Malicious Base64 Unicode WebClient DownloadString M1 rev 2 2017-11-16
snort ET TROJAN Possibly Malicious Double Base64 Unicode Net.ServicePointManager M1 rev 2 2017-11-16
snort ET TROJAN Powershell commands sent B64 1 rev 1 2017-11-16
snort ET TROJAN Possibly Malicious Double Base64 Unicode Net.ServicePointManager M3 rev 2 2017-11-16
snort ET TROJAN Possibly Malicious Double Base64 Unicode Net.ServicePointManager M2 rev 2 2017-11-16
snort ET TROJAN Powershell commands sent when remote host claims to send an image rev 1 2017-11-16
snort ET TROJAN Powershell commands sent B64 3 rev 1 2017-11-16
snort ET WEB_CLIENT PWNJS JS Constructs rev 2 2017-11-15
snort ET TROJAN Lazarus FALLCHILL Fake SSL Checkin 1 rev 2 2017-11-14