Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET DYN_DNS DYNAMIC_DNS Query to a * .meridiano .com .br Domain rev 2 2024-11-14
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.rustyfoundation .com domain rev 2 2024-11-14
suricata ET DYN_DNS DYNAMIC_DNS Query to a * .is-very .fun Domain rev 2 2024-11-14
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a * .is-very .fun Domain rev 2 2024-11-14
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a * .shredsnow .com Domain rev 2 2024-11-14
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a * .bobwohl .com Domain rev 2 2024-11-14
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a * .gethow .com Domain rev 2 2024-11-14
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a * .fumoff .com Domain rev 2 2024-11-14
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a * .stormfood .com Domain rev 2 2024-11-14
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a * .kbmax .sg Domain rev 2 2024-11-14
suricata ET DYN_DNS DYNAMIC_DNS Query to a * .bobwohl .com Domain rev 2 2024-11-14
snort ET INFO HTTP Redirect Chain With Image Filetype in URI rev 1 2024-11-13
sigma Potentially Suspicious Cabinet File Expansion test 2024-11-13
snort ET CURRENT_EVENTS Generic Phishing - Successful Landing Interaction rev 2 2024-11-12
snort ET WEB_SERVER SELECT SUBSTR/ING in URI Possible Blind SQL Injection Attempt rev 5 2024-11-12
suricata ET PHISHING Generic Phishing - Successful Landing Interaction rev 3 2024-11-12
suricata ET WEB_SERVER SELECT SUBSTR/ING in URI Possible Blind SQL Injection Attempt rev 10 2024-11-12
snort ET CURRENT_EVENTS DadSec Credential Phish Landing Page 2024-11-06 rev 2 2024-11-07
snort ET CURRENT_EVENTS DadSec Credential Phish Landing Page 2024-11-07 rev 1 2024-11-07
suricata ET PHISHING DadSec Credential Phish Landing Page 2024-11-06 rev 3 2024-11-07
suricata ET PHISHING DadSec Credential Phish Landing Page 2024-11-07 rev 1 2024-11-07
sigma Potentially Suspicious Azure Front Door Connection test 2024-11-07
snort ET CURRENT_EVENTS Suspected BULLSreCaptcha Credential Phish Landing Page 2024-10-18 rev 1 2024-11-06
snort ET TROJAN HTTP Request to Remcos Payload M1 rev 1 2024-11-06
snort ET CURRENT_EVENTS Successful BULLSreCaptcha Credential Phish M1 2024-10-18 rev 1 2024-11-06
snort ET TROJAN HTTP Request to Remcos Payload M2 rev 1 2024-11-06
snort ET CURRENT_EVENTS Google Redirect to Generic Credential Phish Landing Page 2024-11-05 rev 1 2024-11-06
snort ET CURRENT_EVENTS BULLSreCaptcha Credential Phish Landing Page M3 2024-10-17 rev 1 2024-11-06
snort ET CURRENT_EVENTS Successful BULLSreCaptcha Credential Phish M2 2024-10-18 rev 1 2024-11-06
snort ET CURRENT_EVENTS BULLSreCaptcha Credential Phish - Request for Landing Page 2024-10-17 rev 1 2024-11-06
suricata ET PHISHING Successful BULLSreCaptcha Credential Phish M1 2024-10-18 rev 1 2024-11-06
suricata ET PHISHING BULLSreCaptcha Credential Phish - Request for Landing Page 2024-10-17 rev 1 2024-11-06
suricata ET MALWARE HTTP Request to Remcos Payload M2 rev 1 2024-11-06
suricata ET PHISHING Google Redirect to Generic Credential Phish Landing Page 2024-11-05 rev 1 2024-11-06
suricata ET PHISHING Successful BULLSreCaptcha Credential Phish M2 2024-10-18 rev 1 2024-11-06
suricata ET PHISHING Suspected BULLSreCaptcha Credential Phish Landing Page 2024-10-18 rev 1 2024-11-06
suricata ET PHISHING BULLSreCaptcha Credential Phish Landing Page M3 2024-10-17 rev 1 2024-11-06
suricata ET MALWARE HTTP Request to Remcos Payload M1 rev 1 2024-11-06
snort ET TROJAN [NCSC] Pygmy Goat SSH Banner rev 1 2024-11-05
snort ET TROJAN [NCSC] Pygmy Goat SSH ed25519 Key rev 1 2024-11-05