Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Emotet CnC Beacon rev 1 2014-11-12
snort ET TROJAN OSX/WireLurker CnC Beacon rev 2 2014-11-12
snort ET TROJAN Miuref/Boaxxe Checkin rev 5 2014-11-08
snort ET TROJAN OSX/WireLurker checkin rev 1 2014-11-07
snort ET CURRENT_EVENTS Nuclear SilverLight Exploit rev 1 2014-11-07
snort ET TROJAN OSX/WireLurker HTTP Request for www.comeinbaby.com rev 3 2014-11-07
snort GPL VOIP SIP 401 Unauthorized Flood rev 5 2014-11-06
snort ET TROJAN Cohhoc RAT CnC Request rev 2 2014-11-04
snort ET TROJAN Variant.Strictor Dropper rev 5 2014-11-04
snort ET CURRENT_EVENTS Fiesta SilverLight 5.x Exploit URI Struct rev 1 2014-11-03
snort ET POLICY Office Document Containing AutoOpen Macro Via smtp rev 2 2014-10-31
snort ET POLICY Office Document Containing AutoExec Macro Via smtp rev 2 2014-10-31
snort ET POLICY Office Document Download Containing AutoExec Macro rev 1 2014-10-31
snort ET POLICY Office Document Containing AutoOpen Macro Via smtp rev 2 2014-10-31
snort ET TROJAN Win32/Hikit Server Authentication Response rev 2 2014-10-31
snort ET POLICY Office Document Containing AutoExec Macro Via smtp rev 2 2014-10-31
snort ET POLICY Office Document Containing AutoExec Macro Via smtp rev 2 2014-10-31
snort ET POLICY Office Document Containing AutoOpen Macro Via smtp rev 2 2014-10-31
snort ET SMTP SUSPICIOUS SMTP Attachment Inbound PPT attachment with Embedded OLE Object M1 rev 2 2014-10-31
snort ET CURRENT_EVENTS Fiesta Flash Exploit URI Struct rev 6 2014-10-31
snort GPL SNMP SNMP trap Format String detected rev 5 2014-10-30
snort ET TROJAN Win32/Ropest.H CnC - INBOUND rev 1 2014-10-30
snort ET TROJAN Win32/Ropest.H CnC - INBOUND set rev 1 2014-10-30
snort GPL VOIP SIP 407 Proxy Authentication Required Flood rev 4 2014-10-30
snort GPL TFTP MISC TFTP32 Get Format string attempt rev 3 2014-10-30
snort GPL VOIP SIP INVITE message flooding rev 4 2014-10-30
snort GPL VOIP EXPLOIT SIP UDP Softphone overflow attempt rev 2 2014-10-30
snort ET TROJAN Sofacy HTTP Request microsof-update.com rev 2 2014-10-29
snort ET TROJAN W32/ZxShell Server Checkin Response rev 1 2014-10-29
snort ET TROJAN OLDBAIT Checkin sptr rev 2 2014-10-28
snort GPL CHAT Jabber/Google Talk Outoing Message rev 3 2014-10-28
snort ET WEB_SERVER WEB-PHP phpinfo access rev 5 2014-10-28
snort ET TROJAN OLDBAIT Checkin 2 brvc rev 5 2014-10-28
snort GPL CHAT Google Talk Startup rev 3 2014-10-28
snort GPL CHAT Google Talk Version Check rev 4 2014-10-28
snort GPL CHAT Jabber/Google Talk Outgoing Traffic rev 3 2014-10-28
snort GPL CHAT Jabber/Google Talk Logon Success rev 3 2014-10-28
snort GPL CHAT Google Talk Logon rev 4 2014-10-28
snort GPL CHAT Jabber/Google Talk Incoming Message rev 3 2014-10-28
snort ET TROJAN W32/Siggen.Dropper CnC Beacon rev 1 2014-10-27