Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET WEB_CLIENT Tech Support Phone Scam Landing M1 Oct 16 2016 rev 7 2024-04-28
suricata ET MALWARE Sisproc update rev 8 2024-04-28
suricata ET MALWARE Gamarue/Andromeda Downloading Payload rev 5 2024-04-28
suricata ET MALWARE Win32/Neutrino Checkin rev 9 2024-04-28
suricata ET ADWARE_PUP PUP.GigaClicks Checkin rev 6 2024-04-28
suricata ET MALWARE JS/HTA Downloader Behavior M3 rev 8 2024-04-28
suricata ET MALWARE ArtraDownloader/TeleRAT Checkin rev 6 2024-04-28
suricata ET EXPLOIT Possible NGINX Reference LDAP Query Injection Attack rev 4 2024-04-28
suricata ET MALWARE FF-RAT Stage 1 CnC Checkin rev 5 2024-04-28
suricata ET EXPLOIT_KIT RIG EK Broken/Filtered Payload Download Jun 19 2017 rev 6 2024-04-28
suricata ET PHISHING Weebly Phishing Landing Observed 2015-11-10 rev 5 2024-04-28
suricata ET ADWARE_PUP MultiPlug.A checkin rev 6 2024-04-28
suricata ET MALWARE Android/AhMyth RAT Init Checkin rev 3 2024-04-28
suricata ET MALWARE Sakula/Mivast RAT CnC Beacon 6 rev 6 2024-04-28
suricata ET WEB_CLIENT Tech Support Phone Scam Landing M1 Jun 29 2016 rev 7 2024-04-28
suricata ET ADWARE_PUP Potentially Unwanted Application AirInstaller rev 11 2024-04-28
suricata ET MALWARE KeyBase Keylogger Checkin rev 6 2024-04-28
suricata ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2022-1471 Vulnerable Server Detected Version 6.13.x - 6.15.x M2 rev 2 2024-04-27
suricata ET WEB_CLIENT WebDAV PUT Request for .url Flowbit Set rev 2 2024-04-27
suricata ET WEB_SPECIFIC_APPS MOVEit File Transfer - Payload Trigger Request - CVE-2023-34362 Stage 5b rev 2 2024-04-27
suricata ET MALWARE Kaiten User Agent rev 2 2024-04-27
suricata ET MALWARE OrbitalBeam CnC Token Request rev 2 2024-04-27
suricata ET MALWARE Earth Preta PUBLOAD Activity M1 rev 3 2024-04-27
suricata ET MALWARE Win32/Comotor.A!dll Reporting 1 rev 9 2024-04-27
suricata ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - Guest Account Creation - CVE-2023-34362 Stage 1a rev 2 2024-04-27
suricata ET INFO Lucy Security - Server Reply rev 6 2024-04-27
suricata ET MALWARE Observed Sharp Panda APT Related Activity M2 rev 2 2024-04-27
suricata ET HUNTING Possible cs2nginx Proxy Redirect rev 5 2024-04-27
suricata ET PHISHING Suspected Evri Phish Landing Page 2023-12-01 rev 2 2024-04-27
suricata ET MALWARE Backdoor.Win32.Sykipot Checkin rev 6 2024-04-27
suricata ET MALWARE Turla APT Kazuar Backdoor Related Activity rev 2 2024-04-27
suricata ET MALWARE Generic Stealer Checkin rev 2 2024-04-27
suricata ET ADWARE_PUP Keenvalue Update Engine rev 11 2024-04-27
suricata ET WEB_SERVER LEMURLOOT WebShell Interaction Header - X-siLock-Step1 -2 Health Check User Delete Request - Observed in MOVEit File Transfer - INBOUND rev 2 2024-04-27
suricata ET MALWARE Brosql Stealer Browser Login Exfil rev 2 2024-04-27
suricata ET HUNTING WebDAV Retrieving .zip containing .exe rev 2 2024-04-27
suricata ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - SQLi Payload Creation - CVE-2023-34362 Stage 1b rev 2 2024-04-27
suricata ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request rev 2 2024-04-27
suricata ET MALWARE Suspected Turla APT Kazuar Backdoor Related Activity rev 2 2024-04-27
suricata ET MALWARE CMDEmber Backdoor Style Request rev 2 2024-04-27