Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup rev 1 2024-05-28
sigma CA Policy Updated by Non Approved Actor test 2024-05-28
sigma Uncommon File Creation By Mysql Daemon Process test 2024-05-27
sigma Network Connection Initiated To Cloudflared Tunnels Domains test 2024-05-27
sigma System Information Discovery Via Sysctl - MacOS test 2024-05-27
sigma Uncommon Process Access Rights For Target Image test 2024-05-27
snort ET TROJAN Unknown RAT CnC Checkin rev 1 2024-05-23
suricata ET MALWARE Unknown RAT CnC Checkin rev 1 2024-05-23
snort ET TROJAN Observed UNK_ConsoleCollie Malicious SSL Cert rev 1 2024-05-22
snort ET EXPLOIT D-Link DIR-X4860 RCE Attempt Inbound rev 1 2024-05-22
snort ET EXPLOIT Attempted IDSVSE IP Camera RCE rev 2 2024-05-22
snort ET TROJAN UNK_ConsoleCollie Payload Retrieval Attempt rev 1 2024-05-22
snort ET SCAN OpenVASVT RCE Test String in HTTP Request Inbound M3 rev 1 2024-05-22
snort ET TROJAN DNS query for Morto RDP worm related domain jifr.net rev 5 2024-05-22
snort ET SCAN OpenVASVT RCE Test String in HTTP Request Inbound M2 rev 1 2024-05-22
snort ET SCAN OpenVASVT RCE Test String in HTTP Request Inbound rev 3 2024-05-22
snort ET TROJAN UNK_ConsoleCollie CnC Checkin rev 1 2024-05-22
snort ET SCAN OpenVASVT RCE Test String in HTTP Request Outbound rev 3 2024-05-22
suricata ET EXPLOIT D-Link DIR-X4860 RCE Attempt Inbound rev 1 2024-05-22
suricata ET MALWARE UNK_ConsoleCollie Payload Retrieval Attempt rev 1 2024-05-22
suricata ET SCAN OpenVASVT RCE Test String in HTTP Request Inbound rev 3 2024-05-22
suricata ET MALWARE DNS query for Morto RDP worm related domain jifr.net rev 8 2024-05-22
suricata ET SCAN OpenVASVT RCE Test String in HTTP Request Inbound M2 rev 1 2024-05-22
suricata ET EXPLOIT Attempted IDSVSE IP Camera RCE rev 2 2024-05-22
suricata ET SCAN OpenVASVT RCE Test String in HTTP Request Inbound M3 rev 1 2024-05-22
suricata ET MALWARE Observed UNK_ConsoleCollie Malicious SSL Cert rev 1 2024-05-22
suricata ET MALWARE UNK_ConsoleCollie CnC Checkin rev 1 2024-05-22
suricata ET SCAN OpenVASVT RCE Test String in HTTP Request Outbound rev 3 2024-05-22
snort ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M1 rev 3 2024-05-21
snort ET TROJAN AnonymousRAT Payload Retrieval Attempt rev 1 2024-05-21
snort ET WEB_SERVER ATTACKER SQLi - SELECT and Schema Columns M2 rev 1 2024-05-21
snort ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M3 rev 1 2024-05-21
snort ET WEB_SERVER ATTACKER SQLi - SELECT and Schema Columns M1 rev 2 2024-05-21
snort ET WEB_SERVER SQLi - SELECT and sysobject M2 rev 1 2024-05-21
snort ET TROJAN x64/Generic Red Team Activity CnC Response rev 1 2024-05-21
snort ET WEB_SERVER SQLi - SELECT and sysobject M1 rev 2 2024-05-21
snort ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M2 rev 1 2024-05-21
suricata GPL CHAT ICQ access rev 16 2024-05-21
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server] rev 6 2024-05-21
suricata GPL WEB_SERVER .htpasswd access rev 10 2024-05-21