Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Lazarus FALLCHILL Fake SSL Checkin 2 rev 1 2017-11-14
snort ET WEB_CLIENT SocEng Fake Font Download Template Nov 14 2017 rev 1 2017-11-14
snort ET TROJAN Win32/RCAP CnC Checkin rev 1 2017-11-14
snort ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain rev 2 2017-11-14
snort ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain rev 2 2017-11-14
snort ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain rev 2 2017-11-14
snort ET CURRENT_EVENTS Successful Commonwealth Bank Phish Fake Error Page 2015-08-20 rev 2 2017-11-11
snort ET CURRENT_EVENTS Successful Facebook Phish 2015-08-27 rev 2 2017-11-11
snort ET CURRENT_EVENTS Successful OWA Account Phish 2015-08-21 rev 2 2017-11-11
snort ET CURRENT_EVENTS Successful Impots.gouv.fr Phish M1 2015-08-21 rev 3 2017-11-11
snort ET CURRENT_EVENTS Successful Commonwealth Bank Phish 2015-08-20 rev 2 2017-11-11
snort ET CURRENT_EVENTS Successful Webmail Phish 2015-08-27 rev 2 2017-11-11
snort ET CURRENT_EVENTS Successful Impots.gouv.fr Phish M2 2015-08-21 rev 2 2017-11-11
snort ET CURRENT_EVENTS Successful Telstra Phish M1 2015-09-05 rev 2 2017-11-10
snort ET TROJAN 404 Response with an EXE Attached - Likely Malware Drop rev 14 2017-11-10
snort ET CURRENT_EVENTS Apple Phishing Landing Nov 10 2017 rev 2 2017-11-10
snort ET TROJAN DDoS.Win32/Nitol.B Checkin rev 3 2017-11-09
snort ET CURRENT_EVENTS Successful Generic Phish - Observed in Apple/Bank of America/Amazon 2016-10-26 rev 2 2017-11-09
snort ET WEB_CLIENT pshell dl/execute primitives in wideb64 6 rev 2 2017-11-08
snort ET TROJAN W32/Dinwod.Dropper Win32/Xtrat.B CnC Beacon rev 5 2017-11-07
snort ET WEB_CLIENT pshell dl/execute primitives in wideb64 2 rev 1 2017-11-07
snort ET ATTACK_RESPONSE 401TRG Perl DDoS IRCBot File Download rev 1 2017-11-07
snort ET TROJAN Win32/TrojanDownloader.Delf.BVP Win32/BioData CnC Beacon rev 2 2017-11-07
snort ET TROJAN Volex - OceanLotus JavaScript Fake Page URL Builder Response rev 3 2017-11-07
snort ET WEB_CLIENT pshell dl/execute primitives in wideb64 5 rev 1 2017-11-07
snort ET WEB_CLIENT pshell dl/execute primitives in wideb64 3 rev 1 2017-11-07
snort ET CURRENT_EVENTS Excel/Adobe Online Phishing Landing Nov 25 2015 rev 3 2017-11-07
snort ET WEB_CLIENT pshell dl/execute primitives in wideb64 1 rev 1 2017-11-07
snort ET TROJAN [PTsecurity] Win32/Randrew!rfn CnC Activity rev 1 2017-11-06
snort ET CURRENT_EVENTS Possible Unknown TDS /top2.html rev 2 2017-11-06
snort ET CURRENT_EVENTS Successful Sparkasse Phish Nov 03 2017 rev 2 2017-11-03
snort ET CURRENT_EVENTS Successful Raiffeisen Phish Nov 03 2017 rev 2 2017-11-03
snort ET TROJAN SAD Ransomware CnC Activity rev 2 2017-11-03
snort ET MOBILE_MALWARE Android Marcher Trojan Download - Austrian Bank Targeting rev 2 2017-11-03
snort ET CURRENT_EVENTS 401TRG Successful Multi-Email Phish - Observed in Docusign/Dropbox/Onedrive/Gdrive Nov 02 2017 rev 2 2017-11-02
snort ET TROJAN W32/Asprox.FakeAV Affiliate Download Location Response - Likely Pay-Per-Install For W32/Papras.Spy or W32/ZeroAccess rev 2 2017-11-01
snort ET TROJAN W32/Asprox.FakeAV Affiliate Second Stage Download Location Request rev 2 2017-11-01
snort ET EXPLOIT Possible Oracle Identity Manager Attempt to Logon with default account rev 1 2017-11-01
snort ET WEB_CLIENT DLL or EXE File From Possible WebDAV Share Possible DLL Preloading Exploit Attempt rev 5 2017-11-01
snort ET CURRENT_EVENTS Successful Free.fr Phish 2016-03-10 rev 2 2017-11-01