Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET JA3 Hash - Possible RustyBuer Client Activity rev 2 2024-03-15
suricata ET WEB_CLIENT VLC Media Player .ass File Buffer Overflow Attempt rev 8 2024-03-15
suricata ET MALWARE Socks666 Successful Connect Packet Packet rev 8 2024-03-15
sigma Uncommon Outbound Kerberos Connection - Security test 2024-03-15
sigma Uncommon Outbound Kerberos Connection test 2024-03-15
snort ET TROJAN NewBot Loader CnC Checkin rev 1 2024-03-14
suricata ET MALWARE PawnStorm Java Class Stage 1 M1 Aug 28 2015 rev 3 2024-03-14
suricata ET MALWARE NanoCore RAT Keepalive Response 3 rev 7 2024-03-14
suricata GPL NETBIOS DCERPC msqueue little endian bind attempt rev 6 2024-03-14
suricata ET EXPLOIT_KIT Possible Glazunov Java payload request /5-digit rev 5 2024-03-14
suricata ET GAMES Growtopia Hack - WrongGrow CnC Activity rev 2 2024-03-14
suricata ET MALWARE MSIL/PSW.Agent.SUD Zipped Data Exfil rev 3 2024-03-14
suricata GPL NETBIOS SMB IActivation little endian bind attempt rev 5 2024-03-14
suricata ET MALWARE C3Pool CoinMiner Setup Script Download rev 2 2024-03-14
suricata ET EXPLOIT_KIT RIG encrypted payload M1 Aug 01 2017 rev 3 2024-03-14
suricata ET PHISHING Paypal Phishing Landing 2018-04-09 rev 2 2024-03-14
suricata ET PHISHING Possible Successful Phish - Generic Status Messages Sept 11 2015 rev 6 2024-03-14
suricata ET WEB_CLIENT Malicious SCF File Inbound rev 4 2024-03-14
suricata ET WEB_CLIENT Google Chrome Pdfium JPEG2000 Heap Overflow rev 3 2024-03-14
suricata ET EXPLOIT_KIT DRIVEBY Sednit EK IE Exploit CVE-2013-1347 M1 rev 4 2024-03-14
suricata ET CHAT IRC USER command rev 18 2024-03-14
suricata GPL NETBIOS SMB-DS IActivation unicode bind attempt rev 5 2024-03-14
suricata ET MALWARE Likely Trojan Multi-part Macro Download M1 rev 4 2024-03-14
suricata ET PHISHING Badoo Phishing Landing 2018-07-19 rev 4 2024-03-14
suricata ET PHISHING Possible Dropbox Phishing Landing - Title over non SSL rev 4 2024-03-14
suricata GPL NETBIOS SMB-DS msqueue bind attempt rev 5 2024-03-14
suricata GPL NETBIOS SMB IPC$ unicode share access rev 18 2024-03-14
suricata ET EXPLOIT QNAP Shellshock script retrieval rev 5 2024-03-14
suricata ET PHISHING Mailbox Verification Phishing Landing 2018-01-31 rev 3 2024-03-14
suricata ET PHISHING Paypal Phishing Landing 2018-01-03 rev 2 2024-03-14
suricata ET PHISHING Paypal Phishing Landing 2018-05-09 rev 2 2024-03-14
suricata ET EXPLOIT_KIT SunDown EK RIP Landing M1 B642 rev 3 2024-03-14
suricata ET EXPLOIT Ecessa WANWorx WVR-30 Cross-Site Request Forgery rev 2 2024-03-14
suricata ET WEB_CLIENT pshell dl/execute primitives in wideb64 6 rev 2 2024-03-14
suricata ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation - Responding with Superuser Credentials rev 2 2024-03-14
suricata ET INFO Possible SSLv2 Negotiation in Progress Server Hello rev 3 2024-03-14
suricata GPL NETBIOS SMB-DS llsrpc bind attempt rev 5 2024-03-14
suricata ET MALWARE Drovorub monitor Module Server Response rev 3 2024-03-14
suricata ET MALWARE Drovorub cloud.auth Module Server Response rev 2 2024-03-14
suricata ET PHISHING Ourtime Phishing Landing 2018-03-12 rev 3 2024-03-14