Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE [NCSC] Pygmy Goat SSH Banner rev 1 2024-11-05
suricata ET MALWARE [NCSC] Pygmy Goat SSH ed25519 Key rev 1 2024-11-05
sigma Python Spawning Pretty TTY Via PTY Module test 2024-11-04
sigma App Assigned To Azure RBAC/Microsoft Entra Role test 2024-11-04
sigma Python Reverse Shell Execution Via PTY And Socket Modules test 2024-11-04
snort ET CURRENT_EVENTS BlackShadow Raphael Company Impersonation Form Submission rev 1 2024-11-01
suricata ET MALWARE Win32/BugSleep CnC Checkin rev 3 2024-11-01
suricata ET PHISHING BlackShadow Raphael Company Impersonation Form Submission rev 1 2024-11-01
sigma .RDP File Created By Uncommon Application test 2024-11-01
sigma Command Executed Via Run Dialog Box - Registry test 2024-11-01
sigma Potentially Suspicious Command Executed Via Run Dialog Box - Registry test 2024-11-01
sigma Potential Data Exfiltration Over SMTP Via Send-MailMessage Cmdlet test 2024-11-01
snort ET TROJAN Observed UAC-0050 CnC Activity rev 1 2024-10-31
suricata ET MALWARE Observed UAC-0050 CnC Activity rev 1 2024-10-31
suricata ET MALWARE Win32/BugSleep Command Response From C2 rev 1 2024-10-30
snort ET POLICY Vulnerable Java Version 11.0.x Detected rev 13 2024-10-29
snort ET MOBILE_MALWARE Android/TrickMo.Banker GET Config Request rev 1 2024-10-29
snort ET MOBILE_MALWARE Android/TrickMo.Banker POST Request rev 1 2024-10-29
snort ET MOBILE_MALWARE Android/TrickMo.Banker Config Response rev 1 2024-10-29
suricata ET INFO Vulnerable Java Version 11.0.x Detected rev 14 2024-10-29
suricata ET MOBILE_MALWARE Android/TrickMo.Banker Config Response rev 1 2024-10-29
suricata ET MOBILE_MALWARE Android/TrickMo.Banker POST Request rev 1 2024-10-29
suricata ET MOBILE_MALWARE Android/TrickMo.Banker GET Config Request rev 1 2024-10-29
snort ET CURRENT_EVENTS ReverseLoader Base64 Payload Inbound M2 rev 3 2024-10-24
snort ET INFO Fortinet FortiManager API DVM Add Device rev 1 2024-10-24
suricata ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2 rev 4 2024-10-24
suricata ET HUNTING Fortinet FortiManager API DVM Add Device rev 1 2024-10-24
snort ET INFO Bluetrait Heartbeat Check-in - Server Response rev 1 2024-10-23
snort ET CURRENT_EVENTS ReverseLoader Base64 Payload Inbound rev 2 2024-10-23
snort ET CURRENT_EVENTS TA399/Sidewinder Credential Phish Landing Page M3 2022-11-18 rev 2 2024-10-23
snort ET RETIRED Suspected TA399/SideWinder Phishing Activity - Landing Page URI Pattern rev 3 2024-10-23
snort ET INFO Bluetrait RMM Initial Check-in Observed rev 1 2024-10-23
suricata ET PHISHING TA399/Sidewinder Credential Phish Landing Page M2 2022-11-18 rev 2 2024-10-23
suricata ET INFO Bluetrait RMM Initial Check-in Observed rev 1 2024-10-23
suricata ET INFO Bluetrait Heartbeat Check-in - Server Response rev 1 2024-10-23
suricata ET PHISHING TA399/Sidewinder Credential Phish Landing Page M3 2022-11-18 rev 2 2024-10-23
suricata ET RETIRED Suspected TA399/SideWinder Phishing Activity - Landing Page URI Pattern rev 5 2024-10-23
snort ET TROJAN ClickFix Fake Browser Update Page Inbound M2 rev 1 2024-10-21
snort ET INFO Single Character jpg Requested via PowerShell rev 1 2024-10-21
suricata ET MALWARE ClickFix Fake Browser Update Page Inbound M2 rev 1 2024-10-21