Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CURRENT_EVENTS Possible iTunes Phishing Landing - Title over non SSL rev 2 2017-06-16
snort ET CURRENT_EVENTS Possible DHL Phishing Landing - Title over non SSL rev 2 2017-06-16
snort ET CURRENT_EVENTS Possible Facebook Help Center Phishing Landing - Title over non SSL rev 1 2017-06-16
snort ET CURRENT_EVENTS Possible Alibaba Phishing Landing - Title over non SSL rev 2 2017-06-16
snort ET CURRENT_EVENTS Possible Free Mobile Phishing Landing - Title over non SSL rev 1 2017-06-16
snort ET CURRENT_EVENTS Possible AOL Mail Phishing Landing - Title over non SSL rev 1 2017-06-16
snort ET CURRENT_EVENTS Possible Adobe ID Phishing Landing - Title over non SSL rev 1 2017-06-16
snort ET CURRENT_EVENTS Possible Yahoo Phishing Landing - Title over non SSL rev 2 2017-06-16
snort ET CURRENT_EVENTS Possible Chase Phishing Landing - Title over non SSL rev 2 2017-06-16
snort ET CURRENT_EVENTS Possible Google Docs Phishing Landing - Title over non SSL rev 1 2017-06-16
snort ET CURRENT_EVENTS Possible Yahoo Phishing Landing - Title over non SSL rev 2 2017-06-16
snort ET CURRENT_EVENTS Possible OWA Mail Phishing Landing - Title over non SSL rev 1 2017-06-16
snort ET CURRENT_EVENTS Possible Dropbox Phishing Landing - Title over non SSL rev 1 2017-06-16
snort ET TROJAN DPRK HIDDEN COBRA DDoS Handshake Success rev 2 2017-06-15
snort ET TROJAN DPRK HIDDEN COBRA Botnet C2 Host Beacon rev 2 2017-06-15
snort ET TROJAN W32/Madness Checkin rev 5 2017-06-13
snort ET SCAN Possible Nmap User-Agent Observed rev 3 2017-06-13
snort ET CURRENT_EVENTS Nemucod JS Downloader June 12 2017 rev 1 2017-06-13
snort ET TROJAN X-Malware-Sinkhole Header in HTTP Response rev 1 2017-06-13
snort ET CURRENT_EVENTS Successful Apple Phishing 2016-03-03 rev 2 2017-06-12
snort ET CURRENT_EVENTS Generic Credit Card Information in HTTP POST - Possible Successful Phish Jun 12 2017 rev 1 2017-06-12
snort ET CURRENT_EVENTS Successful Poste Italiane Phish Jun 08 2017 rev 2 2017-06-09
snort ET TROJAN PLATINUM Dipsind CnC Beacon rev 1 2017-06-09
snort ET INFO Possible Successful Hostinger Generic Phish Jun 09 2017 rev 1 2017-06-09
snort ET TROJAN OpenSSH in ICMP Payload - Possible Covert Channel rev 1 2017-06-08
snort ET CURRENT_EVENTS Bingo EK Payload Download rev 1 2017-06-08
snort ET CURRENT_EVENTS SunDown EK RIP Landing M1 B642 rev 1 2017-06-07
snort ET TROJAN Win32/Oliga Fake User Agent rev 3 2017-06-07
snort ET CURRENT_EVENTS SunDown EK RIP Landing M4 B641 rev 1 2017-06-07
snort ET CURRENT_EVENTS SunDown EK RIP Landing M1 B643 rev 1 2017-06-07
snort ET CURRENT_EVENTS SunDown EK RIP Landing M4 B642 rev 1 2017-06-07
snort ET CURRENT_EVENTS SunDown EK RIP Landing M1 B641 rev 1 2017-06-07
snort ET TROJAN Executioner Ransomware Reporting Infection via SMTP rev 1 2017-06-06
snort ET WEB_CLIENT Office Requesting .HTA File Likely CVE-2017-0199 Request rev 4 2017-06-06
snort ET TROJAN MSIL/Unk.HT-Based Ransomware CnC Checkin rev 1 2017-06-06
snort ET TROJAN IRC Private message on non-standard port rev 16 2017-06-06
snort ET CURRENT_EVENTS SUSPICIOUS Request for Grey Advertising Often Leading to EK rev 2 2017-06-06
snort ET TROJAN Win32/Fireball Activity rev 1 2017-06-03
snort ET CURRENT_EVENTS Terror EK Landing T1 Jun 02 2017 M2 rev 1 2017-06-02
snort ET CURRENT_EVENTS Terror EK Payload URI T1 Jun 02 2017 M2 rev 1 2017-06-02