Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Successful Impots.gouv.fr Phish M1 2015-08-21 rev 7 2024-04-13
suricata ET PHISHING Successful Paypal Phish M1 Dec 8 2015 rev 8 2024-04-13
suricata ET MALWARE Scarlet Mimic DNS Lookup 25 rev 6 2024-04-13
suricata ET PHISHING Successful SeniorPeopleMeet Phish M2 2016-09-14 rev 5 2024-04-13
suricata ET MALWARE MICROPSIA HTTP Failover Response M1 rev 5 2024-04-13
suricata ET PHISHING Successful Google Docs Phish 2015-12-09 rev 6 2024-04-13
suricata ET MALWARE BlackTech ELF/TSCookie CnC Observed in DNS Query rev 3 2024-04-13
suricata ET PHISHING Successful Microsoft Account Phish 2019-01-29 rev 3 2024-04-13
suricata ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain rev 6 2024-04-13
suricata ET MALWARE WSHRAT Credential Dump Module Download Command Inbound rev 4 2024-04-13
suricata ET MALWARE APT28 DealersChoice DNS Lookup rev 6 2024-04-13
suricata ET MALWARE ShellCrew.APT StreamEx DNS Lookup 24 rev 6 2024-04-13
suricata ET PHISHING Successful Google Drive Phish 2016-12-22 rev 7 2024-04-13
suricata ET MALWARE Win32.Bicololo Response 2 rev 6 2024-04-13
suricata ET PHISHING Successful Personalized DHL Phish 2016-10-20 rev 7 2024-04-13
suricata ET PHISHING Successful Microsoft Live Email Account Phish 2016-10-18 rev 7 2024-04-13
suricata ET PHISHING Successful EC21 B2B Phish 2016-10-21 rev 7 2024-04-13
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 3 2024-04-13
suricata ET ADWARE_PUP Hex Encoded IP HTTP Request - Likely Malware rev 8 2024-04-13
suricata ET PHISHING Successful Wells Fargo Phish M1 2016-11-18 rev 7 2024-04-13
suricata ET PHISHING Successful Synchronize Email Account Phish 2016-06-15 rev 7 2024-04-13
suricata ET PHISHING Successful Paypal Phish M2 2016-10-05 rev 5 2024-04-13
suricata ET PHISHING Successful Ameli.fr Phish M2 Oct 26 2016-10-26 rev 6 2024-04-13
suricata ET PHISHING Successful PHOEN!X Apple Phish M2 2015-12-29 rev 6 2024-04-13
suricata ET EXPLOIT FCM-MB40 Attempted Remote Command Execution as Root rev 4 2024-04-13
suricata ET PHISHING Possible Successful Google Drive Phish 2015-07-28 rev 6 2024-04-13
suricata ET PHISHING Successful Gmail Phish M1 2016-10-12 rev 7 2024-04-13
suricata ET WEB_SERVER Binget PHP Library User Agent Inbound rev 5 2024-04-13
suricata ET MALWARE Zhelatin npopup Update Detected rev 7 2024-04-13
suricata ET MALWARE Sofacy DNS Lookup check-fix.com rev 7 2024-04-13
suricata ET PHISHING Successful Dropbox Phish 2015-11-04 rev 7 2024-04-13
suricata ET PHISHING Successful Wells Fargo Phish 2016-10-05 rev 7 2024-04-13
suricata ET MALWARE WSHRAT CnC Checkin rev 3 2024-04-13
suricata ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Femas.b Apps List Exfil rev 6 2024-04-13
suricata ET PHISHING Successful PNC Bank Phish M2 2016-10-14 rev 7 2024-04-13
suricata ET MALWARE APT32 Win32/Ratsnif Submitting Output of Command to CnC rev 4 2024-04-13
suricata ET PHISHING Successful iTunes Connect Phish M2 2016-12-13 rev 7 2024-04-13
suricata ET MALWARE DNS Query for Suspicious tolotor.com Domain - Possible CryptoWall Activity rev 6 2024-04-13
suricata ET PHISHING Successful Bank of America Phish M2 2016-08-31 rev 7 2024-04-13
suricata ET PHISHING Successful Generic Banking Phish 2016-10-28 rev 8 2024-04-13