Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Apple Phishing Landing 2015-07-27 rev 4 2024-03-14
suricata ET HUNTING SUSPICIOUS Path to BusyBox rev 3 2024-03-14
suricata GPL NETBIOS SMB-DS irot unicode bind attempt rev 5 2024-03-14
suricata GPL NETBIOS SMB-DS irot little endian bind attempt rev 5 2024-03-14
suricata ET INFO Onion/TOR Proxy Client Request rev 3 2024-03-14
suricata GPL NETBIOS SMB DCERPC LSASS direct bind attempt rev 9 2024-03-14
suricata ET EXPLOIT_KIT Disdain EK Payload Aug 23 2017 rev 4 2024-03-14
suricata GPL NETBIOS SMB IPC$ share access rev 18 2024-03-14
suricata GPL NETBIOS SMB ISystemActivator bind attempt rev 5 2024-03-14
suricata ET MALWARE Possible Malicious Gzip PowerShell over HTTP rev 3 2024-03-14
suricata ET EXPLOIT Ghostscript invalidcheck escape attempt rev 2 2024-03-14
suricata ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound rev 3 2024-03-14
suricata ET WEB_CLIENT pshell dl/execute primitives in wideb64 6 rev 2 2024-03-14
suricata ET EXPLOIT_KIT DRIVEBY Sednit EK IE Exploit CVE-2013-1347 M1 rev 4 2024-03-14
suricata ET PHISHING Microsoft Edge SmartScreen Page Spoof Attempt Dec 16 2016 rev 3 2024-03-14
suricata ET EXPLOIT_KIT KaiXin Landing Page Nov 25 2014 rev 3 2024-03-14
suricata ET CHAT GaduGadu Chat Server Welcome Packet rev 7 2024-03-14
suricata ET PHISHING Badoo Phishing Landing 2018-07-19 rev 4 2024-03-14
suricata ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M2 rev 4 2024-03-14
suricata GPL NETBIOS SMB irot unicode bind attempt rev 5 2024-03-14
suricata ET PHISHING Ourtime Phishing Landing 2018-03-12 rev 3 2024-03-14
suricata ET MALWARE Possible SharpShooter Framework Generated VBS Script rev 2 2024-03-14
suricata ET MALWARE Likely Trojan Multi-part Macro Download M1 rev 4 2024-03-14
suricata ET PHISHING Outlook Web App Phishing Landing 2018-02-07 rev 2 2024-03-14
suricata ET PHISHING Mailbox Verification Phishing Landing 2018-01-31 rev 3 2024-03-14
suricata ET PHISHING Craigslist Phishing Landing 2018-02-26 rev 2 2024-03-14
suricata ET PHISHING Possible Capital One Phishing Landing - Title over non SSL rev 2 2024-03-14
suricata ET PHISHING Possible DHL Phishing Landing - Title over non SSL rev 3 2024-03-14
suricata ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Response rev 4 2024-03-14
suricata ET CHAT IRC USER command rev 18 2024-03-14
suricata ET MALWARE Drovorub cloud.auth Module Server Response rev 2 2024-03-14
suricata ET MALWARE Possible Veil Powershell Encoder B642 rev 3 2024-03-14
suricata GPL NETBIOS SMB-DS IActivation unicode bind attempt rev 5 2024-03-14
suricata ET PHISHING Paypal Phishing Landing 2018-01-03 rev 2 2024-03-14
suricata ET PHISHING Generic Mailbox Phishing Landing 2018-08-30 rev 2 2024-03-14
suricata ET PHISHING Centurylink Phishing Landing 2018-04-19 rev 2 2024-03-14
suricata ET EXPLOIT Ecessa WANWorx WVR-30 Cross-Site Request Forgery rev 2 2024-03-14
suricata ET MALWARE Likely Malicious Windows SCT Download MSXMLHTTP AX rev 3 2024-03-14
suricata ET PHISHING Anonisma Paypal Phishing Loading Page 2015-12-29 rev 3 2024-03-14
suricata ET MALWARE Parallax CnC Response Activity M17 rev 2 2024-03-14