Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Meterpreter or Other Reverse Shell SSL Cert rev 4 2024-04-25
suricata ET MALWARE MacOS/UpdateAgent.A CnC Activity M1 rev 3 2024-04-25
suricata ET MALWARE Win32/PSW.WOW.NLZ CnC Activity rev 3 2024-04-25
suricata ET MALWARE Unk.DPRK MalDoc SysInfo CnC Exfil rev 2 2024-04-25
suricata ET INFO AmeriTechnology Group - CHARM Client rev 2 2024-04-25
suricata ET HUNTING Possible UPnP UUID Overflow Exploit Attempt from Internal Host - NOTIFY rev 2 2024-04-25
suricata ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraAX Default X509 Certificate String rev 2 2024-04-25
suricata ET MALWARE TA399/Sidewinder Maldoc Activity rev 2 2024-04-25
suricata ET HUNTING Possible UPnP UUID Overflow Exploit Attempt from Internal Host - SUBSCRIBE/UNSUBSCRIBE rev 2 2024-04-25
suricata ET EXPLOIT Possible WatchGuard CVE-2022-26318 RCE Attempt M3 rev 3 2024-04-25
suricata ET MALWARE MSIL/Small.FU Variant CnC Activity M1 rev 3 2024-04-25
suricata ET MALWARE MSIL/Small.FU Variant CnC Activity M3 rev 2 2024-04-25
suricata ET MALWARE Observed Karen Ransomware CnC Checkin rev 2 2024-04-25
suricata ET MOBILE_MALWARE Oscorp/UBEL Activity rev 3 2024-04-25
suricata ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraN4 Default X509 Certificate String rev 2 2024-04-25
suricata ET MALWARE Likely Malicious SSL Cert With Script Tags rev 4 2024-04-25
suricata ET MALWARE Possible LINE DANCER Backdoor Connection Attempt rev 1 2024-04-25
suricata ET ADWARE_PUP Win32/MobiGame Install Stats Checkin M3 rev 2 2024-04-25
suricata ET MALWARE Suspected MuddyWater Related CnC Activity rev 2 2024-04-25
suricata ET INFO External IP Address Request via wttr .in rev 2 2024-04-25
suricata ET INFO Namecheap URL Forward rev 3 2024-04-25
suricata ET MALWARE Win32/SVCReady Loader CnC Activity rev 2 2024-04-25
suricata ET MALWARE Win32/CopperStealer CnC Activity M2 rev 6 2024-04-25
suricata ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-3620 Default X509 Certificate String rev 2 2024-04-25
suricata ET MALWARE Winter Vivern Retrieving Commands rev 2 2024-04-25
suricata ET MALWARE MacOS/UpdateAgent.A CnC Activity M2 rev 3 2024-04-25
suricata ET MALWARE Lazarus Related Maldoc Activity rev 2 2024-04-25
suricata ET MALWARE ELF/Roboto - Possible Encrypted Roboto P2P Payload Requested M1 rev 4 2024-04-25
suricata ET ADWARE_PUP Carder Card Checking Tool try2check.me SSL Certificate rev 6 2024-04-25
suricata ET MALWARE Suspected Malicious VBS Script Activity rev 2 2024-04-25
suricata ET MALWARE Jupyter Stealer Reporting System Information M2 rev 2 2024-04-25
suricata ET MALWARE Win32/Beapy/Lemon_Duck CnC Checkin rev 6 2024-04-25
suricata ET ADWARE_PUP Win32/Systweak Checkin M2 rev 2 2024-04-25
sigma Python Path Configuration File Creation - Windows test 2024-04-25
sigma PUA - SoftPerfect Netscan Execution test 2024-04-25
sigma Python Path Configuration File Creation - MacOS test 2024-04-25
sigma Python Path Configuration File Creation - Linux test 2024-04-25
sigma Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation test 2024-04-25
sigma RegAsm.EXE Initiating Network Connection To Public IP test 2024-04-25
snort ET TROJAN Win32/ProcessKiller CnC - Server Side rev 1 2024-04-24