Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET INFO Android.Plankton/Tonclank Successful Installation Device Information POST Message Body rev 7 2024-04-13
suricata ET INFO Python-urllib/ Suspicious User Agent rev 10 2024-04-13
suricata ET PHISHING Successful Facebook Phish 2018-04-16 rev 4 2024-04-13
suricata ET ADWARE_PUP Win32/DealPly Configuration File Inbound rev 6 2024-04-13
suricata ET ADWARE_PUP AdWare.Win32.Sushi.au Checkin rev 9 2024-04-13
suricata ET MALWARE Cayosin Botnet User-Agent Observed M1 rev 6 2024-04-13
suricata ET PHISHING Successful LinkedIn Phish 2015-09-17 rev 7 2024-04-13
suricata ET PHISHING Successful Google Drive Phish M1 2016-09-01 rev 6 2024-04-13
suricata ET PHISHING Successful Wells Fargo Phish 2021-03-16 rev 3 2024-04-13
suricata ET PHISHING Successful Paypal Phish M2 2016-11-29 rev 9 2024-04-13
suricata ET MALWARE Win32/Filecoder.STOP Variant Public Key Download rev 5 2024-04-13
suricata ET PHISHING Successful Sparkasse Credential Phish M1 2022-04-13 rev 3 2024-04-13
suricata ET MALWARE Ransomware Locky .onion Payment Domain rev 5 2024-04-13
suricata ET MALWARE Gamaredon CnC Domain in DNS Lookup rev 4 2024-04-13
suricata ET INFO WinRM wsman Access - Possible Lateral Movement rev 4 2024-04-13
suricata ET PHISHING Successful Phish OWA Credentials 2016-08-16 rev 6 2024-04-13
suricata ET PHISHING Successful HealthEquity Phish 2016-09-01 rev 7 2024-04-13
suricata ET PHISHING Successful Keybank Phish 2016-09-29 rev 7 2024-04-13
suricata ET PHISHING Successful Paypal Phish Mar 22 2017 rev 5 2024-04-13
suricata ET PHISHING Successful Wells Fargo Phish M1 2016-12-29 rev 7 2024-04-13
suricata ET PHISHING Generic Personalized Google Firebase Hosted Phishing Landing rev 3 2024-04-13
suricata ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain rev 6 2024-04-13
suricata ET PHISHING Successful Windows Live Phish 2016-12-23 rev 5 2024-04-13
suricata ET PHISHING Successful Google Drive/Dropbox Phish Nov 20 2016 rev 7 2024-04-13
suricata ET MALWARE Observed DNS Query to Gryphon CnC Domain / GlobeImposter Payment Domain rev 6 2024-04-13
suricata ET MALWARE Operation Tripoli Related CnC Checkin rev 4 2024-04-13
suricata ET MALWARE Operation EvilTraffic Initial Redirect M2 rev 7 2024-04-13
suricata ET PHISHING Possible Successful Generic Phish 2015-07-31 rev 6 2024-04-13
suricata ET EXPLOIT TP-LINK TL-WR340G Router DNS Change GET Request rev 7 2024-04-13
suricata ET PHISHING Successful AOL Phish M1 2016-07-14 rev 6 2024-04-13
suricata ET USER_AGENTS pxyscand/ Suspicious User Agent Outbound rev 5 2024-04-13
suricata ET PHISHING Successful Office 365 Phish 2016-11-18 rev 7 2024-04-13
suricata ET PHISHING Successful Adobe Shared Document Phish 2016-11-15 rev 6 2024-04-13
suricata ET MALWARE Sofacy DNS Lookup checkwinframe.com rev 7 2024-04-13
suricata ET MALWARE ShellCrew.APT StreamEx DNS Lookup 23 rev 6 2024-04-13
suricata ET PHISHING Successful Facebook Payment Phish M1 2016-09-29 rev 7 2024-04-13
suricata ET INFO PCHunter Download Observed rev 3 2024-04-13
suricata ET ADWARE_PUP W32/Amonetize.Downloader Executable Download Request rev 7 2024-04-13
suricata ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain rev 6 2024-04-13
suricata ET MALWARE ELF.SystemdMiner C2 Domain in DNS Lookup rev 5 2024-04-13