Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Backdoor.Win32.DarkComet Screenshot Upload Successful rev 1 2015-10-23
snort ET CURRENT_EVENTS Yahoo Account Phish Landing 2015-10-23 rev 1 2015-10-22
snort ET CURRENT_EVENTS Successful Zimbra Account Phish 2015-10-23 rev 1 2015-10-22
snort ET TROJAN NetWire Variant - Client Hello rev 2 2015-10-22
snort ET CURRENT_EVENTS Chase Account Phish Landing Oct 22 rev 1 2015-10-22
snort ET TROJAN NetWire Variant - Server Directory Listing Request rev 2 2015-10-22
snort ET CURRENT_EVENTS Possible click2play bypass Oct 19 2015 as observed in PawnStorm rev 3 2015-10-21
snort ET WEB_CLIENT Fake Java Installer Landing Page Oct 21 rev 1 2015-10-21
snort ET WEB_SPECIFIC_APPS Open Web Analytics owa_action Parameter Local File inclusion Attempt rev 3 2015-10-20
snort ET CURRENT_EVENTS Successful USAA Phish 2015-10-20 rev 1 2015-10-20
snort ET WEB_SPECIFIC_APPS Open Web Analytics owa_do Parameter Local File inclusion Attempt rev 3 2015-10-20
snort ET TROJAN Backdoor.Meciv Checkin rev 3 2015-10-20
snort ET WEB_SPECIFIC_APPS DBHcms editmenu Parameter UPDATE SET SQL Injection Attempt rev 3 2015-10-19
snort ET TROJAN Nemucod Downloading Payload 2 rev 2 2015-10-19
snort GPL FTP USER overflow attempt rev 35 2015-10-19
snort ET CURRENT_EVENTS Successful Google Drive Phish 2015-09-22 rev 2 2015-10-19
snort ET WEB_SPECIFIC_APPS DBHcms editmenu Parameter INSERT INTO SQL Injection Attempt rev 3 2015-10-19
snort ET WEB_SPECIFIC_APPS DBHcms editmenu Parameter UNION SELECT SQL Injection Attempt rev 3 2015-10-19
snort ET WEB_SPECIFIC_APPS DBHcms editmenu Parameter DELETE FROM SQL Injection Attempt rev 3 2015-10-19
snort ET CURRENT_EVENTS Successful Paypal Account Phish 2015-10-16 rev 1 2015-10-16
snort ET CURRENT_EVENTS Successful Paypal Account Phish 2015-10-16 rev 1 2015-10-16
snort ET WEB_CLIENT APT SWC PluginDetect Landing Cookie 2015-10-15 rev 1 2015-10-15
snort ET TROJAN JS/Nemucod.M.gen downloading EXE payload rev 1 2015-10-15
snort ET TROJAN JS/Nemucod.M.gen downloading PDF payload rev 1 2015-10-15
snort ET CURRENT_EVENTS Possible Magento Directory Traversal Attempt rev 1 2015-10-15
snort ET CURRENT_EVENTS Successful Outlook Web App Phish 2015-10-15 rev 1 2015-10-14
snort ET SCAN abdullkarem Wordpress PHP Scanner rev 1 2015-10-14
snort ET TROJAN Win32/Kelihos.F Checkin rev 3 2015-10-13
snort ET CURRENT_EVENTS Successful Samsung Portal Phish 2015-10-13 rev 1 2015-10-13
snort ET CURRENT_EVENTS Netgear Multiple Router Auth Bypass rev 1 2015-10-12
snort ET WEB_CLIENT Proxy - Fiddler Proxy Certificate Seen rev 1 2015-10-10
snort ET WEB_CLIENT Proxy - OWASP Zed Attack Proxy Certificate Seen rev 1 2015-10-10
snort ET WEB_CLIENT Proxy - BurpSuite PortSwigger Proxy Certificate Seen rev 1 2015-10-10
snort ET TROJAN Gh0st Remote Access Trojan Encrypted Session To CnC Server rev 4 2015-10-09
snort ET TROJAN Linux/dtool IRC Command Complete 3 rev 3 2015-10-08
snort ET TROJAN Linux/dtool IRC Command Complete 1 rev 4 2015-10-08
snort ET MOBILE_MALWARE Android/Kemoge Checkin rev 1 2015-10-08
snort ET CURRENT_EVENTS Successful Webmail Update Phish 2015-10-08 rev 1 2015-10-08
snort ET MOBILE_MALWARE Android/Kemoge Checkin 2 rev 1 2015-10-08
snort ET TROJAN Linux/dtool IRC Command Complete 2 rev 4 2015-10-08