Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata GPL NETBIOS SMB-DS irot little endian bind attempt rev 5 2024-03-14
suricata ET PHISHING Facebook Mobile Phishing Landing 2018-02-26 rev 2 2024-03-14
suricata ET PHISHING Smartermail Phishing Landing 2018-02-20 rev 2 2024-03-14
suricata ET MALWARE Win32/Ropest.H CnC - INBOUND set rev 3 2024-03-14
suricata ET INFO ZoneAlarm Download Flowbit Set rev 4 2024-03-14
suricata ET WEB_CLIENT DRIVEBY EXE Embeded in Page Likely Evil M1 rev 3 2024-03-14
suricata ET PHISHING Email Verification/Upgrade Phishing Landing 2018-01-22 rev 2 2024-03-14
suricata ET INFO Cisco Data Center Network Manager - Vulnerable Version Detected 11.1 rev 3 2024-03-14
suricata ET WEB_SERVER ATTACKER WebShell - 1337w0rm - Landing Page rev 4 2024-03-14
suricata ET EXPLOIT CVE-2017-0199 Common Obfus Stage 2 DL rev 3 2024-03-14
suricata ET INFO WinHttpRequest Downloading EXE rev 9 2024-03-14
suricata ET EXPLOIT_KIT RIG EK Payload Jun 26 2016 rev 4 2024-03-14
suricata GPL NETBIOS SMB winreg unicode bind attempt rev 6 2024-03-14
suricata ET INFO Java Downloading Archive flowbit no alert rev 8 2024-03-14
suricata ET EXPLOIT CVE-2016-3210 Exploit Observed ITW M1 Nov 30 rev 3 2024-03-14
suricata ET PHISHING Possible Free Mobile Phishing Landing - Title over non SSL rev 3 2024-03-14
suricata ET EXPLOIT Possible Android Stagefright MP4 CVE-2015-1538 - ROP rev 3 2024-03-14
suricata ET MALWARE Possible click2play bypass Oct 19 2015 as observed in PawnStorm rev 5 2024-03-14
suricata GPL NETBIOS SMB llsrpc little endian bind attempt rev 5 2024-03-14
suricata GPL NETBIOS SMB-DS DCERPC ISystemActivator bind attempt rev 14 2024-03-14
suricata GPL NETBIOS SMB llsrpc unicode little endian bind attempt rev 5 2024-03-14
suricata ET PHISHING Successful Outlook Webmail Account Phish 2015-09-02 rev 4 2024-03-14
suricata ET MALWARE Win32/NetDooka Framework RAT Sending Session ID rev 4 2024-03-14
suricata ET EXPLOIT_KIT DRIVEBY [PwC CTD] -- MultiGroup - ScanBox and Targetted Watering Holes ActiveX Call rev 4 2024-03-14
suricata ET PHISHING Chalbhai Phishing Landing 2018-03-12 rev 2 2024-03-14
suricata ET PHISHING Possible Google Drive/Dropbox Phishing Landing Jul 10 2015 rev 4 2024-03-14
suricata ET PHISHING Bank of America Phishing Landing 2018-08-30 rev 2 2024-03-14
suricata ET PHISHING Square Phishing Landing 2018-02-15 rev 2 2024-03-14
suricata ET INFO Possible SSLv2 Negotiation in Progress Client Master Key SSL2_RC4_128_WITH_MD5 rev 3 2024-03-14
suricata ET EXPLOIT_KIT Spelevo EK Landing M3 rev 2 2024-03-14
suricata ET PHISHING Generic MRxJoker Phishing Landing 2018-09-27 rev 2 2024-03-14
suricata ET PHISHING Wells Fargo Phishing Landing 2018-02-13 rev 2 2024-03-14
suricata GPL NETBIOS SMB ISystemActivator unicode little endian bind attempt rev 5 2024-03-14
suricata ET INFO Anonymous LDAPv3 Bind Request Outbound rev 3 2024-03-14
suricata ET EXPLOIT Firefox 0-day used against TOR browser Nov 29 2016 M1 rev 3 2024-03-14
suricata ET MALWARE MSIL/Agent.TRM Task Command rev 2 2024-03-14
suricata ET PHISHING Anonisma Phishing Landing 2015-12-01 rev 3 2024-03-14
suricata ET WEB_CLIENT Samsung Galaxy Knox Android Browser RCE smdm attempt rev 5 2024-03-14
suricata ET WEB_CLIENT Possible Internet Explorer VBscript failure to handle error case information disclosure obfuscated CVE-2014-6332 rev 4 2024-03-14
suricata ET PHISHING Bank of America Phishing Landing 2018-01-18 M1 rev 2 2024-03-14