Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Win32/Enosch.A gtalk connectivity check rev 8 2024-04-14
suricata ET MALWARE OilRig APT PowDesk Powershell Check rev 5 2024-04-14
suricata ET MALWARE Ransomware.Hidden-Tear Variant CnC Checkin rev 8 2024-04-14
suricata ET INFO Certificate with Unknown Content M2 rev 3 2024-04-14
suricata ET MALWARE BKDR_BTMINE.MNR BitCoin Miner Server Checkin rev 6 2024-04-14
suricata ET MALWARE TrueBot/Silence.Downloader Keep-Alive rev 5 2024-04-14
suricata ET MALWARE Gamut Spambot Checkin Response rev 6 2024-04-14
suricata ET MALWARE CenterPOS CnC 2 rev 6 2024-04-14
suricata ET PHISHING Successful Mailbox Update Phish 2016-02-17 rev 8 2024-04-14
suricata ET EXPLOIT_KIT Spelevo VBS Payload Downloaded rev 6 2024-04-14
suricata ET MALWARE Zeus Bot Connectivity Check rev 27 2024-04-14
suricata ET MALWARE CozyDuke APT Possible SSL Cert 2 rev 6 2024-04-14
suricata ET MALWARE Win32/TrojanDownloader.Waski.F Locker DL URI Struct Jul 25 2014 rev 7 2024-04-14
suricata ET P2P Ocelot BitTorrent Server in Use rev 5 2024-04-14
suricata ET MALWARE Win32/Vflooder.C Connectivity Check rev 7 2024-04-14
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice POST] rev 6 2024-04-14
suricata ET ADWARE_PUP Win32/Agent.PMS Variant CnC Activity rev 14 2024-04-14
suricata ET MALWARE CozyDuke APT Possible SSL Cert 6 rev 6 2024-04-14
suricata ET MALWARE SmokeLoader Checkin rev 9 2024-04-14
suricata ET MALWARE Win32/Trojan.Agent.AXMO CnC Beacon rev 6 2024-04-14
suricata ET MALWARE Legion Loader Activity Observed rev 4 2024-04-14
suricata ET MALWARE CozyDuke APT Possible SSL Cert 3 rev 6 2024-04-14
suricata ET MALWARE Tortoiseshell/HMH Download Request rev 5 2024-04-14
sigma Malware User Agent test 2024-04-14
suricata ET MALWARE CustomRAT DNS lookup rev 6 2024-04-13
suricata ET PHISHING Successful Facebook Phish 2019-08-29 rev 3 2024-04-13
suricata ET EXPLOIT Eir D1000 Remote Command Injection Attempt Outbound rev 3 2024-04-13
suricata ET MALWARE APT28 Zebrocy/Zekapab CnC Checkin rev 4 2024-04-13
suricata ET PHISHING Possible Successful Tripod.com Phish 2016-03-31 rev 5 2024-04-13
suricata ET PHISHING Successful iCloud Phish 2015-12-02 rev 6 2024-04-13
suricata ET MALWARE Cryptowall 3.0 .onion Proxy Domain rev 5 2024-04-13
suricata ET MALWARE APT28 DealersChoice DNS Lookup rev 7 2024-04-13
suricata ET PHISHING Successful Paypal Phish 2015-10-23 rev 7 2024-04-13
suricata ET PHISHING Successful US Bank Phish 2016-06-09 M2 rev 5 2024-04-13
suricata ET MALWARE Observed DNS Query to Reborn/Ovidiy Stealer CnC Domain rev 6 2024-04-13
suricata ET MALWARE Scarlet Mimic DNS Lookup 1 rev 6 2024-04-13
suricata ET MALWARE Critroni Variant .onion Proxy Domain rev 5 2024-04-13
suricata ET PHISHING Facebook Phishing Domain in DNS Lookup rev 4 2024-04-13
suricata ET PHISHING Successful Linkedin Phish 2016-12-09 rev 7 2024-04-13
suricata ET PHISHING Successful Dropbox Phish 2016-10-25 rev 7 2024-04-13