Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET EXPLOIT Possible Elasticsearch CVE-2015-1427 Exploit Campaign SSL Certificate rev 4 2024-04-12
suricata ET PHISHING Successful Bank of America Phish M1 Oct 01 2012 rev 6 2024-04-12
suricata ET PHISHING Successful Liqui Cryptocurrency Exchange Phish 2017-12-28 rev 3 2024-04-12
suricata ET MALWARE Win32.HLLW.Autoruner USA_Load UA rev 5 2024-04-12
suricata ET PHISHING Possible Successful Remax Phish - AOL Creds Jun 23 2015 rev 7 2024-04-12
suricata ET INFO SUSPICIOUS UA starting with Mozilla/8 rev 7 2024-04-12
suricata ET MALWARE W32/Ke3chang.Snake.APT Campaign CnC Beacon rev 4 2024-04-12
suricata ET MALWARE Win32/Oliga Fake User Agent rev 7 2024-04-12
suricata ET MALWARE [PTsecurity] Gozi/Ursnif Payload v12 rev 4 2024-04-12
suricata ET INFO iTunes User Agent rev 10 2024-04-12
suricata ET MALWARE Windows Executable Downloaded With Image Content-Type Header rev 3 2024-04-12
suricata ET PHISHING Successful Google Drive Phish June 17 2015 rev 7 2024-04-12
suricata ET PHISHING Successful Phish Outlook Credentials Oct 01 2015 rev 6 2024-04-12
suricata ET MALWARE Sinowal/sinonet/mebroot/Torpig infected host POSTing process list rev 7 2024-04-12
suricata ET PHISHING Successful Craigslist Phish 2016-04-25 rev 4 2024-04-12
suricata ET EXPLOIT_KIT Possible Red Dot Exploit Kit Single Character JAR Request rev 4 2024-04-12
suricata ET MALWARE W32/Echmark/MarkiRAT CnC Host Checkin rev 3 2024-04-12
suricata ET MALWARE Cryptowall .onion Proxy Domain rev 4 2024-04-12
suricata ET MALWARE Trojan-Downloader.Win32.AutoIt.mj Checkin rev 5 2024-04-12
suricata ET PHISHING Possible Successful Yahoo Phish Jun 23 2015 rev 7 2024-04-12
suricata ET MALWARE W32/Syndicasec.Backdoor CnC Beacon rev 6 2024-04-12
suricata ET MALWARE W32/PointOfSales.Misc CnC Beacon rev 5 2024-04-12
suricata ET MALWARE General Win32 Backdoor Checkin POST rev 8 2024-04-12
suricata ET MALWARE W32/Safe User Agent Fantasia rev 5 2024-04-12
suricata ET MALWARE Win32/Namsoth.A Checkin/NEWSREELS APT1 Related rev 5 2024-04-12
suricata ET MALWARE Skyfall fake Skype install link rev 6 2024-04-12
suricata ET SCAN NETWORK Incoming Masscan detected rev 7 2024-04-12
suricata ET EXPLOIT_KIT RIG Landing URI Struct March 20 2015 rev 5 2024-04-12
suricata ET SCAN ZmEu exploit scanner rev 11 2024-04-12
suricata ET MALWARE DecebalPOS User-Agent rev 5 2024-04-12
suricata ET INFO TOR Consensus Data Requested rev 2 2024-04-12
suricata ET PHISHING Successful Adobe Phish Jun 17 2015 rev 8 2024-04-12
suricata ET MALWARE [PTsecurity] Win32/Randrew!rfn CnC Activity rev 4 2024-04-12
suricata ET MALWARE W32/DownloaderAgent.fajk Second Stage Download List Requested rev 5 2024-04-12
suricata ET INFO SUSPICIOUS UA starting with Mozilla/9 rev 6 2024-04-12
suricata ET EXPLOIT Netgear R7000 Command Injection Exploit rev 4 2024-04-12
suricata ET MALWARE W32/Ke3chang.MyWeb.APT Campaign CnC Beacon rev 4 2024-04-12
suricata ET MALWARE Mazilla Suspicious User-Agent Jan 15 2015 rev 6 2024-04-12
suricata ET USER_AGENTS EmailSiphon Suspicious User-Agent Outbound rev 5 2024-04-12
suricata ET ADWARE_PUP Win32/Adware.iBryte.BO CnC Activity rev 2 2024-04-12