Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET USER_AGENTS User-agent DownloadNetFile Win32.small.hsh downloader rev 12 2017-10-30
snort ET TROJAN IMDDOS Botnet User-Agent i am ddos rev 5 2017-10-30
snort ET TROJAN Win32.Agent.pt User-Agent Detected rev 5 2017-10-30
snort ET USER_AGENTS Ufasoft bitcoin Related User-Agent rev 3 2017-10-30
snort ET MALWARE my247eshop .com User-Agent rev 4 2017-10-30
snort ET USER_AGENTS Tear Application User-Agent Detected rev 5 2017-10-30
snort ET USER_AGENTS Long Fake wget 3.0 User-Agent Detected rev 3 2017-10-30
snort ET TROJAN FakeAV User-Agent XML rev 2 2017-10-30
snort ET USER_AGENTS MacShield User-Agent Likely Malware rev 3 2017-10-30
snort ET MALWARE Win32/Onescan FraudWare User-Agent rev 2 2017-10-30
snort ET USER_AGENTS Suspicious User-Agent _updater_agent rev 2 2017-10-30
snort ET TROJAN Win32.Small.qh/xSock User-Agent Detected rev 5 2017-10-30
snort ET TROJAN IMDDOS Botnet User-Agent kav rev 6 2017-10-30
snort ET USER_AGENTS Dialer-967 User-Agent rev 6 2017-10-30
snort ET TROJAN Win32/Dynamer Trojan Dropper User-Agent VB Http rev 2 2017-10-30
snort ET TROJAN IMDDOS Botnet User-Agent IAMDDOS rev 5 2017-10-30
snort ET TROJAN IMDDOS Botnet User-Agent STORMDDOS rev 5 2017-10-30
snort ET USER_AGENTS Si25f_302 User-Agent rev 4 2017-10-30
snort ET TROJAN Suspicious User-Agent Possible Trojan Downloader Shell rev 8 2017-10-30
snort ET MALWARE W32/SpeedRunner User-Agent SRRemove rev 2 2017-10-30
snort ET USER_AGENTS Downloader User-Agent HTTPGET rev 9 2017-10-30
snort ET USER_AGENTS Suspicious User-Agent Im Luo rev 5 2017-10-30
snort ET TROJAN IMDDOS Botnet User-Agent YTDDOS rev 5 2017-10-30
snort ET CURRENT_EVENTS Successful Woodforest Bank Phish M1 2015-08-31 rev 2 2017-10-29
snort ET CURRENT_EVENTS Horde Webmail Phishing Landing 2015-08-21 rev 2 2017-10-29
snort ET CURRENT_EVENTS Successful Key Bank Phish M1 2015-08-20 rev 2 2017-10-29
snort ET CURRENT_EVENTS Successful Outlook Phish 2015-08-18 rev 2 2017-10-29
snort ET CURRENT_EVENTS Apple ID Phishing Landing 2015-08-19 rev 2 2017-10-29
snort ET CURRENT_EVENTS Successful Horde Webmail Phish 2015-08-21 rev 3 2017-10-29
snort ET CURRENT_EVENTS Successful Horde Webmail Phish 2015-08-21 rev 2 2017-10-29
snort ET CURRENT_EVENTS Successful Amazon Account Phish M3 2015-08-21 rev 2 2017-10-29
snort ET CURRENT_EVENTS Successful Apple ID Phish 2015-08-18 rev 2 2017-10-29
snort ET CURRENT_EVENTS Successful Wells Fargo Account Phish 2015-08-14 rev 2 2017-10-29
snort ET CURRENT_EVENTS Successful Intuit Phish 2016-07-21 rev 2 2017-10-29
snort ET CURRENT_EVENTS Successful Generic 000webhostapp.com Phish 2017-10-27 rev 3 2017-10-29
snort ET CURRENT_EVENTS Successful Key Bank Phish M2 2015-08-20 rev 2 2017-10-29
snort ET CURRENT_EVENTS Successful Wells Fargo Account Phish 2015-08-18 rev 3 2017-10-29
snort ET INFO PUP/PUA OSSProxy HTTP Header rev 12 2017-10-27
snort ET CURRENT_EVENTS Possible BACKSWING JS Framework POST Observed rev 2 2017-10-26
snort ET EXPLOIT AVTECH Authenticated Command Injection in PwdGrp.cgi rev 2 2017-10-25