Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE MuddyWater APT Related Maldoc Checkin M1 rev 4 2024-04-26
suricata ET PHISHING Tech Support Phone Scam Landing 2023-04-17 rev 2 2024-04-26
suricata ET MALWARE ReverseRat 3.0 CnC Checkin M1 rev 2 2024-04-26
suricata ET MALWARE Win32/Valyria Maldoc Payload Request M1 rev 2 2024-04-26
suricata ET MALWARE Havoc Framework CnC Response rev 2 2024-04-26
suricata ET WEB_SERVER LEMURLOOT WebShell Interaction Header - X-siLock-Step1 -1 Data Exfil Request - Observed in MOVEit File Transfer - INBOUND rev 2 2024-04-26
sigma Outbound Network Connection Initiated By Microsoft Dialer test 2024-04-26
sigma AWS User Login Profile Was Modified test 2024-04-26
snort ET TROJAN Generic - POST To .php w/Extended ASCII Characters rev 11 2024-04-25
snort ET TROJAN Possible LINE DANCER Backdoor Connection Attempt rev 1 2024-04-25
suricata ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara Default X509 Certificate rev 2 2024-04-25
suricata ET MALWARE MSIL/Small.FU Variant CnC Activity M2 rev 3 2024-04-25
suricata ET MALWARE Win32/Kryptik.HNBU CryptoMiner - Report Request rev 2 2024-04-25
suricata ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraAX Default X509 Certificate String rev 2 2024-04-25
suricata ET MALWARE ELF/Roboto - Possible Encrypted Roboto P2P Payload Requested M1 rev 4 2024-04-25
suricata ET HUNTING Possible UPnP UUID Overflow Exploit Attempt from Internal Host - SUBSCRIBE/UNSUBSCRIBE rev 2 2024-04-25
suricata ET MALWARE Win32/SVCReady Loader Requesting Payload rev 2 2024-04-25
suricata ET MALWARE Lazarus Related Maldoc Activity rev 2 2024-04-25
suricata ET INFO Namecheap URL Forward rev 3 2024-04-25
suricata ET MALWARE MSIL/Small.FU Variant CnC Activity M1 rev 3 2024-04-25
suricata ET MALWARE MSIL/Small.FU Variant CnC Activity M3 rev 2 2024-04-25
suricata ET MOBILE_MALWARE Oscorp/UBEL Activity rev 3 2024-04-25
suricata ET INFO External IP Address Request via wttr .in rev 2 2024-04-25
suricata ET MALWARE Observed Karen Ransomware CnC Checkin rev 2 2024-04-25
suricata ET MALWARE Suspected MuddyWater Related CnC Activity rev 2 2024-04-25
suricata ET MALWARE Win32/SVCReady Loader CnC Activity rev 2 2024-04-25
suricata ET MALWARE Possible LINE DANCER Backdoor Connection Attempt rev 1 2024-04-25
suricata ET ADWARE_PUP Win32/MobiGame Install Stats Checkin M3 rev 2 2024-04-25
suricata ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraN4 Default X509 Certificate String rev 2 2024-04-25
suricata ET MALWARE Win32/CopperStealer CnC Activity M2 rev 6 2024-04-25
suricata ET MALWARE Likely Malicious SSL Cert With Script Tags rev 4 2024-04-25
suricata ET EXPLOIT Apache Ambari Default Credentials Attempt rev 2 2024-04-25
suricata ET MALWARE Jupyter Stealer Reporting System Information M2 rev 2 2024-04-25
suricata ET INFO Possible Autodiscover Credentials Leak via Basic Auth rev 2 2024-04-25
suricata ET MALWARE APT Related CR4T Backdoor Activity rev 2 2024-04-25
suricata ET MALWARE TinyTurla CnC Activity rev 2 2024-04-25
suricata ET MALWARE MSIL/Injector.VVP Downloader Activity M1 rev 3 2024-04-25
suricata ET MALWARE Meterpreter or Other Reverse Shell SSL Cert rev 4 2024-04-25
suricata ET PHISHING Phishery Phishing Tool - Default SSL Certificate Observed rev 3 2024-04-25
suricata ET MALWARE Win32/Malgent!MSR Dropper Requesting Payload rev 2 2024-04-25