Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE ClickFix Fake Browser Update Page Inbound M2 rev 1 2024-10-21
sigma Access To Browser Credential Files By Uncommon Applications - Security test 2024-10-21
snort ET INFO Google AMP Redirect to OpenDrive File Sharing Service rev 1 2024-10-18
suricata ET INFO Google AMP Redirect to OpenDrive File Sharing Service rev 1 2024-10-18
snort ET TROJAN Balada Injector Script rev 3 2024-10-17
snort ET TROJAN BumbleBee Loader CnC Server Response rev 1 2024-10-16
snort ET TROJAN BumbleBee Loader CnC Checkin rev 1 2024-10-16
suricata ET MALWARE BumbleBee Loader CnC Checkin rev 1 2024-10-16
suricata ET MALWARE BumbleBee Loader CnC Server Response rev 1 2024-10-16
snort ET INFO Generic 302 Redirect Google 404 rev 1 2024-10-14
snort ET TROJAN Suspected PrivateLoader CnC Checkin - Server Response rev 1 2024-10-14
snort ET CURRENT_EVENTS Javascript Browser Fingerprinting POST Request rev 1 2024-10-14
suricata ET INFO Generic 302 Redirect Google 404 rev 1 2024-10-14
suricata ET MALWARE Suspected PrivateLoader CnC Checkin - Server Response rev 1 2024-10-14
suricata ET PHISHING Javascript Browser Fingerprinting POST Request rev 1 2024-10-14
snort ET WEB_SPECIFIC_APPS Ivanti Connect Secure Shared Object File Upload Attempt rev 1 2024-10-09
suricata ET WEB_SPECIFIC_APPS Ivanti Connect Secure Shared Object File Upload Attempt rev 1 2024-10-09
snort ET INFO File Download from transfer .sh Service rev 1 2024-10-08
suricata ET FILE_SHARING File Download from transfer .sh Service rev 1 2024-10-08
suricata ET MALWARE Havoc Demon CnC Request rev 1 2024-10-08
sigma HackTool - Certipy Execution test 2024-10-08
sigma LSASS Process Memory Dump Files test 2024-10-08
snort ET TROJAN Havoc Demon CnC Request rev 1 2024-10-07
snort ET EXPLOIT PHP Arbitrary Object Instantiation - ImageMagick MSL File Descriptor RCE rev 1 2024-10-07
snort ET EXPLOIT PHP Arbitrary Object Instantiation RCE - ImageMagick MSL VID Scheme rev 1 2024-10-07
suricata ET EXPLOIT PHP Arbitrary Object Instantiation - ImageMagick MSL File Descriptor RCE rev 1 2024-10-07
suricata ET EXPLOIT PHP Arbitrary Object Instantiation RCE - ImageMagick MSL VID Scheme rev 1 2024-10-07
sigma Disable Windows Defender Functionalities Via Registry Keys test 2024-10-07
sigma Previously Installed IIS Module Was Removed test 2024-10-06
sigma ETW Logging/Processing Option Disabled On IIS Server test 2024-10-06
sigma HTTP Logging Disabled On IIS Server test 2024-10-06
sigma New Module Module Added To IIS Server test 2024-10-06
sigma Process Terminated Via Taskkill test 2024-10-06
snort ET RETIRED Possible LINE RUNNER Backdoor Connection Attempt rev 2 2024-10-04
suricata ET RETIRED Possible LINE RUNNER Backdoor Connection Attempt rev 3 2024-10-04
snort ET RETIRED Mispadu Stealer CnC Checkin M2 rev 2 2024-10-03
snort ET RETIRED Mispadu Stealer CnC Checkin M1 rev 2 2024-10-03
snort ET RETIRED Earth Preta PUBLOAD Activity M3 rev 2 2024-10-03
snort ET RETIRED Earth Preta PUBLOAD Activity M2 rev 2 2024-10-03
snort ET RETIRED Sharp Panda APT Related Activity M3 rev 2 2024-10-03