Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Successful Linkedin Phish 2016-11-17 rev 8 2024-04-13
suricata ET PHISHING Successful Apple Phish M3 Feb 06 2016 rev 6 2024-04-13
suricata ET USER_AGENTS MSIL/Peppy User-Agent rev 4 2024-04-13
suricata ET MALWARE Java Archive sent when remote host claims to send an image rev 7 2024-04-13
suricata ET PHISHING Successful Halkbank Phish M2 2018-04-16 rev 3 2024-04-13
suricata ET MALWARE Observed SystemBC CnC Domain in DNS Query rev 3 2024-04-13
suricata ET ADWARE_PUP Win32/Agent.NDV Receiving Task Config File rev 5 2024-04-13
suricata ET MALWARE S400 RAT Client Checkin via Discord rev 3 2024-04-13
suricata ET ADWARE_PUP Loadmoney.A Checkin 4 rev 8 2024-04-13
suricata ET PHISHING Successful Apple ID Phish 2015-08-18 rev 6 2024-04-13
suricata ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain rev 6 2024-04-13
suricata ET PHISHING Successful Stripe Phish 2016-12-09 rev 7 2024-04-13
suricata ET MALWARE CDT Credphish/Netwire Campaign DNS Lookup rev 6 2024-04-13
suricata ET PHISHING Successful Paypal Phish 2016-10-21 rev 8 2024-04-13
suricata ET PHISHING Successful Excel Phish 2016-11-17 rev 8 2024-04-13
suricata ET PHISHING Successful Paypal Phish M2 2016-11-17 rev 7 2024-04-13
suricata ET PHISHING Successful Universal Webmail Phish 2016-08-19 rev 7 2024-04-13
suricata ET PHISHING Successful US Bank Phish M1 2015-12-22 rev 7 2024-04-13
suricata ET PHISHING Successful Dropbox/Docusign Phish 2016-10-28 rev 6 2024-04-13
suricata ET WEB_CLIENT Great Cannon DDoS JS M3 rev 5 2024-04-13
suricata ET EXPLOIT Possible Tor/Noscript JS Bypass rev 4 2024-04-13
suricata ET PHISHING Successful Apple Phish M1 2016-02-23 rev 8 2024-04-13
suricata ET PHISHING Successful CenturyLink Phish 2016-10-12 rev 7 2024-04-13
suricata ET PHISHING Successful RBC Royal Bank Phish M2 Aug 17 2017 rev 4 2024-04-13
suricata ET PHISHING Successful Barclays Phish M2 2016-10-06 rev 6 2024-04-13
suricata ET USER_AGENTS Aria2 User-Agent rev 4 2024-04-13
suricata ET PHISHING Successful Paypal Phish M4 2016-10-06 rev 7 2024-04-13
suricata ET MALWARE Packed Perl with Eval Statement rev 4 2024-04-13
suricata ET PHISHING Successful Facebook Phish 2018-01-26 rev 4 2024-04-13
suricata ET USER_AGENTS PyCurl Suspicious User Agent Outbound rev 5 2024-04-13
suricata ET MALWARE SLUB Domain in DNS Lookup rev 4 2024-04-13
suricata ET PHISHING Successful Ourtime.com Phish 2016-11-28 rev 7 2024-04-13
suricata ET PHISHING L33bo Phishing Kit - Successful Credential Phish M4 2016-03-29 rev 6 2024-04-13
suricata ET PHISHING Successful Natwest Bank Phish 2015-11-21 rev 7 2024-04-13
suricata ET MALWARE Sofacy DNS Lookup windows-updater.com rev 7 2024-04-13
suricata ET MALWARE DNS Possible User trying to visit POSHCODER.A .onion link outside of torbrowser rev 6 2024-04-13
suricata ET MALWARE W32/Goolbot.E Checkin UA Detected iamx rev 8 2024-04-13
suricata ET PHISHING Successful Gmail Phish 2015-11-05 rev 8 2024-04-13
suricata ET MALWARE Ransomware Locky Possible Payment Page rev 5 2024-04-13
suricata ET MALWARE APT32 Win32/Ratsnif POSTing Log Message to CnC rev 4 2024-04-13