Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET INFO Certificate with Unknown Content M2 rev 3 2024-04-14
suricata ET MALWARE Jaff Ransomware Checkin M1 rev 7 2024-04-14
suricata ET WEB_SERVER JSP.SJavaWebManage WebShell Pass 20-09-2018 1 rev 4 2024-04-14
suricata ET MALWARE DarkGate CNC Checkin rev 7 2024-04-14
suricata ET MALWARE Unknown Trojan with Fake Java User-Agent rev 9 2024-04-14
suricata ET MALWARE APT_NGO_wuaclt rev 8 2024-04-14
suricata ET MALWARE Windows Executable Sent When Remote Host Claims to Send a RAR Archive rev 7 2024-04-14
suricata ET MALWARE Win32/Urausy.C response rev 6 2024-04-14
suricata ET MALWARE W32/Emotet.v4 Checkin rev 10 2024-04-14
suricata ET WEB_SERVER JSP.SJavaWebManage WebShell Access rev 5 2024-04-14
suricata ET MALWARE Waledac Beacon Traffic Detected rev 10 2024-04-14
suricata ET MALWARE Possible Zbot Activity Common Download Struct rev 8 2024-04-14
suricata ET WEB_SERVER Muieblackcat scanner rev 5 2024-04-14
suricata ET EXPLOIT_KIT RIG Exploit URI Struct March 20 2015 rev 6 2024-04-14
suricata ET MALWARE W32/GamesForum.InfoStealer Reporting to CnC rev 7 2024-04-14
suricata ET MALWARE Ransomware.Hidden-Tear Variant CnC Checkin rev 8 2024-04-14
suricata ET MALWARE ConstructorWin32/Agent.V rev 13 2024-04-14
suricata ET MALWARE TickGroup ABK Backdoor CnC Check-in rev 4 2024-04-14
suricata ET INFO GET to Puu.sh for TXT File with Minimal Headers rev 6 2024-04-14
suricata ET MALWARE Powersploit Framework Script Downloaded rev 4 2024-04-14
suricata ET MALWARE Possible TA410 APT FlowCloud Dependency Download rev 3 2024-04-14
suricata ET MALWARE CozyDuke APT Possible SSL Cert 4 rev 6 2024-04-14
suricata ET MALWARE Ransom.Win32.Birele.gsg Checkin rev 7 2024-04-14
suricata ET MALWARE Win32/Cryptrun.B Connectivity check rev 9 2024-04-14
suricata ET INFO imPcRemote Download rev 5 2024-04-14
suricata ET MALWARE Possible Satan Cryptor GeoIP Lookup rev 3 2024-04-14
suricata ET MALWARE Possible TickGroup Snack CnC Activity rev 4 2024-04-14
suricata ET MALWARE f0xy Checkin rev 8 2024-04-14
suricata ET PHISHING Apple Phishing Redirect 2019-01-02 rev 3 2024-04-14
suricata ET MALWARE Possible OceanLotus Time Check to Microsoft.com rev 5 2024-04-14
suricata ET PHISHING Successful DHL Phish 2019-10-18 rev 6 2024-04-14
suricata ET MALWARE PE EXE or DLL Windows file download disguised as ASCII rev 7 2024-04-14
suricata ET MALWARE Possible Windows executable sent when remote host claims to send html content rev 20 2024-04-14
suricata ET MOBILE_MALWARE signed-unsigned integer mismatch code-verification bypass rev 6 2024-04-14
suricata ET EXPLOIT_KIT DRIVEBY Incognito Payload Download /load/*exe rev 12 2024-04-14
suricata ET MALWARE Possible TickGroup Coolbee/Avenger CnC Activity rev 4 2024-04-14
suricata ET EXPLOIT_KIT Possible PurpleFox EK Framework Payload rev 5 2024-04-14
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice Server] rev 6 2024-04-14
suricata ET SCAN libwww-perl GET to // with specific HTTP header ordering without libwww-perl User-Agent rev 14 2024-04-14
suricata ET MALWARE Trojan.Karagany C&C Response rev 5 2024-04-14