Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE BlackTech ELF/TSCookie CnC Observed in DNS Query rev 3 2024-04-13
suricata ET PHISHING Successful Microsoft Account Phish 2019-01-29 rev 3 2024-04-13
suricata ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain rev 6 2024-04-13
suricata ET MALWARE WSHRAT Credential Dump Module Download Command Inbound rev 4 2024-04-13
suricata ET MALWARE APT28 DealersChoice DNS Lookup rev 6 2024-04-13
suricata ET MALWARE ShellCrew.APT StreamEx DNS Lookup 24 rev 6 2024-04-13
suricata ET PHISHING Successful Google Drive Phish 2016-12-22 rev 7 2024-04-13
suricata ET MALWARE Win32.Bicololo Response 2 rev 6 2024-04-13
suricata ET PHISHING Successful Personalized DHL Phish 2016-10-20 rev 7 2024-04-13
suricata ET PHISHING Successful Microsoft Live Email Account Phish 2016-10-18 rev 7 2024-04-13
suricata ET PHISHING Successful EC21 B2B Phish 2016-10-21 rev 7 2024-04-13
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 3 2024-04-13
suricata ET ADWARE_PUP Hex Encoded IP HTTP Request - Likely Malware rev 8 2024-04-13
suricata ET PHISHING Successful Wells Fargo Phish M1 2016-11-18 rev 7 2024-04-13
suricata ET PHISHING Successful Synchronize Email Account Phish 2016-06-15 rev 7 2024-04-13
suricata ET PHISHING Successful Paypal Phish M2 2016-10-05 rev 5 2024-04-13
suricata ET PHISHING Successful Ameli.fr Phish M2 Oct 26 2016-10-26 rev 6 2024-04-13
suricata ET PHISHING Successful PHOEN!X Apple Phish M2 2015-12-29 rev 6 2024-04-13
suricata ET EXPLOIT FCM-MB40 Attempted Remote Command Execution as Root rev 4 2024-04-13
suricata ET PHISHING Possible Successful Google Drive Phish 2015-07-28 rev 6 2024-04-13
suricata ET PHISHING Successful Gmail Phish M1 2016-10-12 rev 7 2024-04-13
suricata ET WEB_SERVER Binget PHP Library User Agent Inbound rev 5 2024-04-13
suricata ET MALWARE Sofacy DNS Lookup check-fix.com rev 7 2024-04-13
suricata ET MALWARE DNS Query for Suspicious tolotor.com Domain - Possible CryptoWall Activity rev 6 2024-04-13
suricata ET PHISHING Successful Wells Fargo Phish M2 2015-11-21 rev 7 2024-04-13
suricata ET PHISHING Successful Paypal Phish 2015-10-23 rev 7 2024-04-13
suricata ET PHISHING Successful AOL Phish 2016-10-24 rev 7 2024-04-13
suricata ET EXPLOIT Possible ZTE ZXV10 H108L Router Root RCE Attempt rev 4 2024-04-13
suricata ET PHISHING Successful Bank of America Phish 2015-11-21 rev 6 2024-04-13
suricata ET MALWARE APT28 Zebrocy/Zekapab Reporting to CnC M3 rev 3 2024-04-13
suricata ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 5 rev 6 2024-04-13
suricata ET PHISHING Successful Generic Webmail Account Phish 2016-07-15 rev 5 2024-04-13
suricata ET PHISHING Successful Amazon Phish M2 2016-10-05 rev 6 2024-04-13
suricata ET MALWARE Critroni Variant .onion Proxy Domain rev 5 2024-04-13
suricata ET PHISHING Successful Personalized Phish 2016-09-14 rev 6 2024-04-13
suricata ET MALWARE Scarlet Mimic DNS Lookup 1 rev 6 2024-04-13
suricata ET PHISHING Successful Dropbox Phish 2016-10-25 rev 7 2024-04-13
suricata ET MALWARE Observed DNS Query to Reborn/Ovidiy Stealer CnC Domain rev 6 2024-04-13
suricata ET PHISHING Successful Paypal Phish 2015-12-24 M1 rev 5 2024-04-13
suricata ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 4 rev 6 2024-04-13