Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE TA399/Sidewinder Activity Payload Request M3, Microsoft Word UA Request for .rtf rev 7 2024-09-26
suricata ET INFO Observed Server Responding with PDD File With Known Dangerous/Exploitable Parameter rev 1 2024-09-26
suricata ET MALWARE TA399/Sidewinder Activity Payload Request M2, Microsoft Office UA Request for .rtf rev 5 2024-09-26
suricata ET MALWARE TA399/Sidewinder Activity Payload Request M1, Microsoft Outlook UA Request for .rtf rev 5 2024-09-26
suricata ET MALWARE Magnet Goblin Linux Nerbian RAT Trigger Sequence from CnC Server rev 1 2024-09-26
snort ET CURRENT_EVENTS Parking Penalty Phish Kit Admin Landing Page M1 2024-09-23 rev 1 2024-09-24
snort ET CURRENT_EVENTS Parking Penalty Phish Kit Admin Landing Page M3 2024-09-23 rev 1 2024-09-24
snort ET INFO Redirect to stockx.com rev 1 2024-09-24
snort ET CURRENT_EVENTS Parking Penalty Phish Kit Admin Landing Page M2 2024-09-23 rev 1 2024-09-24
suricata ET PHISHING Parking Penalty Phish Kit Admin Landing Page M3 2024-09-23 rev 1 2024-09-24
suricata ET PHISHING Parking Penalty Phish Kit Admin Landing Page M1 2024-09-23 rev 1 2024-09-24
suricata ET PHISHING Parking Penalty Phish Kit Admin Landing Page M2 2024-09-23 rev 1 2024-09-24
suricata ET HUNTING Redirect to stockx.com rev 1 2024-09-24
snort ET RETIRED Win32/XFILES Stealer Data Exfiltration Attempt rev 2 2024-09-23
snort ET RETIRED Win32/TyphonReborn Telegram CnC Checkin rev 2 2024-09-23
snort ET RETIRED linux.backdoor.wordpressexploit.1 CnC Checkin rev 2 2024-09-23
snort ET RETIRED WinGO\Monitor.go CnC Checkin rev 2 2024-09-23
snort ET RETIRED Android/RatMilad CnC Checkin rev 2 2024-09-23
snort ET RETIRED GoLinux/GoTrim CnC Checkin rev 2 2024-09-23
suricata ET RETIRED WinGO\Monitor.go CnC Checkin rev 4 2024-09-23
suricata ET RETIRED Win32/TyphonReborn Telegram CnC Checkin rev 3 2024-09-23
suricata ET RETIRED GoLinux/GoTrim CnC Checkin rev 3 2024-09-23
suricata ET RETIRED Android/RatMilad CnC Checkin rev 3 2024-09-23
suricata ET RETIRED linux.backdoor.wordpressexploit.1 CnC Checkin rev 3 2024-09-23
sigma Remote Access Tool - MeshAgent Command Execution via MeshCentral test 2024-09-22
snort ET POLICY External IP Lookup Request rev 3 2024-09-19
snort ET POLICY Observed External IP Lookup SSL Cert rev 3 2024-09-19
snort ET RETIRED MSSQL maggie backdoor ls Query Observed rev 3 2024-09-19
snort ET POLICY Known External IP Lookup Service Domain in SNI rev 3 2024-09-19
snort ET RETIRED Suspected Polonium CnC Initial Checkin M1 rev 2 2024-09-19
snort ET RETIRED WinGo/YT Stealer CnC Checkin rev 2 2024-09-19
snort ET RETIRED Suspected Polonium CnC Initial Checkin M2 rev 2 2024-09-19
snort ET RETIRED WinGo/YT Stealer CnC Domain in DNS Lookup rev 2 2024-09-19
suricata ET INFO Known External IP Lookup Service Domain in SNI rev 5 2024-09-19
suricata ET RETIRED Suspected Polonium CnC Initial Checkin M1 rev 4 2024-09-19
suricata ET INFO Observed External IP Lookup SSL Cert rev 5 2024-09-19
suricata ET RETIRED WinGo/YT Stealer CnC Domain in DNS Lookup rev 3 2024-09-19
suricata ET RETIRED WinGo/YT Stealer CnC Checkin rev 4 2024-09-19
suricata ET INFO External IP Lookup Request rev 4 2024-09-19
suricata ET RETIRED Suspected Polonium CnC Initial Checkin M2 rev 4 2024-09-19