Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET WEB_SPECIFIC_APPS MOVEit File Transfer - Payload Trigger Request - CVE-2023-34362 Stage 5b rev 2 2024-04-27
suricata ET MALWARE CMDEmber Backdoor Style Request rev 2 2024-04-27
suricata ET MALWARE Kaiten User Agent rev 2 2024-04-27
suricata ET MALWARE Win32/Comotor.A!dll Reporting 1 rev 9 2024-04-27
suricata ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - SQLi Payload Creation - CVE-2023-34362 Stage 1b rev 2 2024-04-27
suricata ET HUNTING WebDAV Retrieving .zip rev 2 2024-04-27
suricata ET INFO web.go HTTP Server Value in Response rev 2 2024-04-27
suricata ET WEB_SPECIFIC_APPS MOVEit File Transfer - Folder Request - CVE-2023-34362 Stage 4 rev 2 2024-04-27
suricata ET MALWARE Win32/TA402 Checkin M2 rev 2 2024-04-27
suricata ET INFO Lucy Security - Server Reply rev 6 2024-04-27
suricata ET MALWARE Win32/RustMiner Suspicious HTTP Accept Header Observed rev 2 2024-04-27
suricata ET INFO External Host Sending Docker Swarm Join Command rev 4 2024-04-27
suricata ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2022-1471 Vulnerable Server Detected Version 6.13.x - 6.15.x M1 rev 2 2024-04-27
suricata ET PHISHING Suspected Evri Phish Landing Page 2023-12-01 rev 2 2024-04-27
suricata ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - Guest Account Creation - CVE-2023-34362 Stage 1a rev 2 2024-04-27
suricata ET HUNTING Suspected Gamaredon Template Retrieval rev 2 2024-04-27
suricata ET MALWARE Win32/Gomorrah Stealer Data Exfiltration rev 5 2024-04-27
suricata ET MALWARE Earth Preta PUBLOAD Activity M1 rev 3 2024-04-27
suricata ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - SQLi Payload Creation - CVE-2023-34362 Stage 5a rev 2 2024-04-27
suricata ET MOBILE_MALWARE Android/InfamousChisel.InfoStealer APT28/SANDWORM Data Exfiltration rev 2 2024-04-27
suricata ET WEB_CLIENT WebDAV GET Request for .url Flowbit Set rev 2 2024-04-27
suricata ET MALWARE Generic Stealer Checkin rev 2 2024-04-27
suricata ET MALWARE Turla APT Kazuar Backdoor Related Activity rev 2 2024-04-27
suricata ET MALWARE Brosql Stealer Screenshot Exfil rev 2 2024-04-27
suricata ET MALWARE Brosql Stealer Browser Login Exfil rev 2 2024-04-27
snort ET CURRENT_EVENTS Parrot TDS NDSW Check M2 rev 1 2024-04-26
snort ET INFO Gophish X-Server rev 3 2024-04-26
suricata ET MALWARE ReverseRat 3.0 CnC Checkin M2 rev 2 2024-04-26
suricata ET MALWARE DeltaStealer Exfiltrating Data to gofile .io rev 2 2024-04-26
suricata ET MALWARE Gamut Spambot Checkin rev 9 2024-04-26
suricata ET MALWARE MageCart Skimmer Header Observed Outbound rev 2 2024-04-26
suricata ET PHISHING HiYu - Request for Victim Enrichment rev 2 2024-04-26
suricata ET MALWARE Win32/Wacapew.C!ml Checkin rev 2 2024-04-26
suricata ET MALWARE Suspected Muggle Stealer Activity M2 rev 2 2024-04-26
suricata ET MALWARE Win32/Filecoder.OJC CnC Checkin rev 2 2024-04-26
suricata ET HUNTING Observed Nighthawk 404 Server Response rev 2 2024-04-26
suricata ET MALWARE Win32/Agent.UOI CnC Checkin rev 2 2024-04-26
suricata ET MALWARE Win32.ClipBanker.uhn Exfil rev 2 2024-04-26
suricata ET WEB_SERVER LEMURLOOT WebShell Interaction Header - X-siLock-Step1 -1 Data Exfil Request - Observed in MOVEit File Transfer - INBOUND rev 2 2024-04-26
suricata ET HUNTING Possible PHP Backdoor Command Execution rev 2 2024-04-26