Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE SnappyTCP Reverse Shell Client Checkin M1 rev 3 2024-04-03
suricata ET MALWARE Win32/frebniis IIS Backdoor Trigger Attempt M1 rev 2 2024-04-03
suricata GPL ATTACK_RESPONSE command error rev 11 2024-04-03
suricata ET MALWARE Maldoc CnC Checkin rev 2 2024-04-03
suricata ET MALWARE Trojan-PSW.Win32.Stealer.sb CnC rev 3 2024-04-03
suricata ET MALWARE Xehook Stealer Data Exfiltration Attempt rev 2 2024-04-03
suricata GPL ATTACK_RESPONSE index of /cgi-bin/ response rev 9 2024-04-03
suricata ET INFO Smocker Server Mock Tool Response rev 3 2024-04-03
suricata ET MALWARE Win32/Sventore.B CnC Checkin rev 2 2024-04-03
suricata ET MALWARE Xehook Stealer CnC Checkin rev 3 2024-04-03
suricata ET INFO Terse Request For Bitbucket Snippet rev 3 2024-04-03
suricata ET INFO 404 Response with Javascript Variable in Page rev 2 2024-04-03
suricata GPL ATTACK_RESPONSE id check returned web rev 10 2024-04-03
suricata GPL INFO Linksys router default password login attempt rev 12 2024-04-03
suricata ET MALWARE CargoBay CnC Activity rev 3 2024-04-03
suricata GPL ATTACK_RESPONSE file copied ok rev 15 2024-04-03
suricata ET HUNTING [ANY.RUN] DARKCLOUD Style External IP Check rev 3 2024-04-03
suricata ET PHISHING Tech Support/Refund Scam Landing Inbound 2022/04/25 rev 3 2024-04-03
suricata ET MALWARE Win32/Wacapew CnC Checkin rev 3 2024-04-03
suricata GPL EXPLOIT NTLM ASN.1 vulnerability scan attempt rev 14 2024-04-03
suricata GPL ATTACK_RESPONSE command completed rev 14 2024-04-03
suricata ET MALWARE TA421 Wineloader CnC Checkin M4 rev 3 2024-04-03
suricata ET EXPLOIT_KIT Parrot TDS Check rev 3 2024-04-03
suricata ET MALWARE Win32/VB.PNU CnC Checkin rev 2 2024-04-03
suricata ET MALWARE Win32/Generik.BUTNSNA Checkin rev 2 2024-04-03
suricata ET MALWARE Win32/Wacapew.C!ml CnC Checkin rev 2 2024-04-03
suricata ET CURRENT_EVENTS Possible Crypto Drainer Fetch rev 3 2024-04-03
suricata ET MALWARE Win32/frebniis IIS Backdoor Trigger Attempt M2 rev 2 2024-04-03
suricata ET MALWARE Gamaredon APT Backdoor Related Activity rev 2 2024-04-03
snort ET INFO Possible External IP Check rev 1 2024-04-01
suricata ET MALWARE CozyDuke APT Possible SSL Cert 7 rev 5 2024-04-01
suricata ET MALWARE APT CozyCar SSL Cert 3 rev 5 2024-04-01
elastic Deprecated - Remote File Creation on a Sensitive Directory deprecated 2024-04-01
snort ET TROJAN Linux/Dinodas RAT CnC Checkin - TCP rev 1 2024-03-29
snort ET TROJAN Linux/Dinodas RAT CnC Checkin - UDP rev 1 2024-03-29
suricata ET MALWARE Linux/Dinodas RAT CnC Checkin - UDP rev 1 2024-03-29
suricata ET MALWARE Linux/Dinodas RAT CnC Checkin - TCP rev 1 2024-03-29
snort ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M3 rev 1 2024-03-28
snort ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M2 rev 1 2024-03-28
snort ET TROJAN Large DNS Query possible covert channel rev 10 2024-03-28