Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Forest Blizzard APT - Custom Protocol Handler DLL Registry Set test 2024-04-23
snort ET INFO HTTP POST to WP Theme Directory Without Referer rev 5 2024-04-22
snort ET TROJAN FakeAV Variant CnC Beacon rev 2 2024-04-22
snort ET TROJAN Win32/Geodo Checkin rev 8 2024-04-22
snort ET TROJAN Dyre CnC Checkin rev 2 2024-04-22
snort ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile rev 8 2024-04-22
snort ET TROJAN CBReplay Checkin rev 2 2024-04-22
snort ET TROJAN PlugX CnC Beacon rev 2 2024-04-22
snort ET TROJAN JS/Nemucod requesting EXE payload 2016-02-01 rev 2 2024-04-22
snort ET TROJAN Vawtrak/NeverQuest Posting Data rev 3 2024-04-22
snort ET CURRENT_EVENTS Possible Base64 Obfuscated Phishing Landing 2015-11-30 rev 4 2024-04-22
snort ET CURRENT_EVENTS Xbagger Macro Encrypted DL Jun 13 2016 rev 3 2024-04-22
snort ET TROJAN DustySky CnC Beacon rev 5 2024-04-22
snort ET TROJAN Emotet Checkin rev 4 2024-04-22
snort ET INFO GET Minimal HTTP Headers Flowbit Set rev 2 2024-04-22
suricata ET MALWARE [eSentire] Cobalt Strike Beacon rev 6 2024-04-22
suricata ET MALWARE Possible MSIL/Solorigate.G!dha/SUPERNOVA Webshell Access Request rev 2 2024-04-22
suricata ET MALWARE Win32/Poweliks GET Request rev 7 2024-04-22
suricata ET MALWARE Win32/Backdoor.Randrew.A CnC Checkin rev 4 2024-04-22
suricata ET PHISHING Possible iCloud Phishing Landing - Title over non SSL rev 4 2024-04-22
suricata ET INFO Possible Grams DarkMarket Search DNS Domain Lookup rev 6 2024-04-22
suricata ET MALWARE Win32/Spy.Agent.QAQ Variant CnC Activity rev 2 2024-04-22
suricata ET INFO Outdated Flash Version M2 rev 38 2024-04-22
suricata ET MALWARE Known Hostile Domain ant.trenz .pl Lookup rev 4 2024-04-22
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.GORAT.[SID1] rev 4 2024-04-22
suricata ET PHISHING Possible Apple Phishing Landing - Title over non SSL rev 5 2024-04-22
suricata ET MALWARE Unk.VBSLoader Retrieving Payload rev 4 2024-04-22
suricata ET MALWARE Jupyter Stealer Reporting System Information rev 4 2024-04-22
suricata ET MALWARE APT LuckyMouse Polpo Malware CnC rev 2 2024-04-22
suricata ET CHAT General MSN Chat Activity rev 10 2024-04-22
sigma Uncommon Child Process Of Defaultpack.EXE test 2024-04-22
sigma Potential Binary Proxy Execution Via Cdb.EXE test 2024-04-22
sigma Potential Arbitrary File Download Via Cmdl32.EXE test 2024-04-22
suricata ET MALWARE Suspicious Fake Opera 10 User-Agent rev 7 2024-04-21
suricata ET MALWARE Win32/Poweliks.A Checkin 2 rev 5 2024-04-21
suricata ET MALWARE Platinum APT Activity rev 3 2024-04-21
suricata ET MALWARE Operation Cobra Venom WSF Stage 1 - File Decode Completed rev 4 2024-04-21
suricata ET MALWARE UsefulTyphon CnC Activity M2 rev 3 2024-04-21
suricata ET MALWARE Win32/Pterodo.NG Checkin 2 rev 7 2024-04-21
suricata ET MALWARE MSIL.L4L Stealer IP Check rev 3 2024-04-21