Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Square Phishing Landing 2018-02-15 rev 2 2024-03-14
suricata GPL NETBIOS SMB winreg unicode bind attempt rev 6 2024-03-14
suricata GPL NETBIOS SMB llsrpc little endian bind attempt rev 5 2024-03-14
suricata GPL NETBIOS SMB-DS IActivation unicode little endian bind attempt rev 5 2024-03-14
suricata ET EXPLOIT_KIT DRIVEBY [PwC CTD] -- MultiGroup - ScanBox and Targetted Watering Holes ActiveX Call rev 4 2024-03-14
suricata ET INFO Java Downloading Class flowbit no alert rev 8 2024-03-14
suricata ET MALWARE Downbot/Shady Rat Remote Shell Connection rev 5 2024-03-14
suricata ET PHISHING Successful Bank of America Phish 2015-10-02 rev 3 2024-03-14
suricata ET PHISHING Possible Free Mobile Phishing Landing - Title over non SSL rev 3 2024-03-14
suricata ET EXPLOIT CVE-2017-0199 Common Obfus Stage 2 DL rev 3 2024-03-14
suricata ET WEB_CLIENT Samsung Galaxy Knox Android Browser RCE smdm attempt rev 5 2024-03-14
suricata ET PHISHING Generic Phishing Landing 2018-01-12 rev 2 2024-03-14
suricata ET MALWARE Win32/Ropest.H CnC - INBOUND set rev 3 2024-03-14
suricata ET MALWARE RAMNIT.A M1 rev 3 2024-03-14
suricata ET EXPLOIT_KIT Disdain EK Flash Exploit M1 Aug 23 2017 rev 3 2024-03-14
suricata ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server rev 3 2024-03-14
suricata ET INFO JAVA - Java Serialized Data Download by Vulnerable Client rev 6 2024-03-14
suricata ET EXPLOIT_KIT [PTsecurity] Grandsoft EK Payload rev 4 2024-03-14
suricata ET PHISHING Mailbox Renewal Phish Landing 2015-08-14 rev 5 2024-03-14
suricata ET PHISHING Facebook Phishing Landing 2018-02-12 rev 2 2024-03-14
suricata ET MALWARE Likely Evil EXE download from WinHttpRequest non-exe extension rev 4 2024-03-14
suricata ET WEB_CLIENT Microsoft Excel file download - SET 1 rev 9 2024-03-14
suricata GPL NETBIOS SMB-DS DCERPC LSASS direct bind attempt rev 9 2024-03-14
suricata ET PHISHING Mailbox Verification Phishing Landing 2018-02-07 rev 2 2024-03-14
suricata ET EXPLOIT Possible CVE-2016-2209 Symantec PowerPoint Parsing Buffer Overflow M1 rev 3 2024-03-14
suricata ET EXPLOIT_KIT Unknown EK Secondary Landing Page May 01 2015 M2 rev 3 2024-03-14
suricata GPL NETBIOS SMB-DS irot unicode little endian bind attempt rev 5 2024-03-14
suricata ET PHISHING Google Drive Phishing Landing Jul 24 2015 rev 5 2024-03-14
suricata GPL NETBIOS SMB irot little endian bind attempt rev 5 2024-03-14
suricata ET PHISHING Generic Mailbox Phishing Landing 2018-08-30 rev 2 2024-03-14
suricata ET PHISHING Possible AOL Mail Phishing Landing - Title over non SSL rev 3 2024-03-14
suricata ET EXPLOIT Possible Android Stagefright MP4 CVE-2015-1538 - Shell rev 4 2024-03-14
suricata GPL NETBIOS SMB-DS irot bind attempt rev 5 2024-03-14
suricata GPL NETBIOS SMB winreg little endian bind attempt rev 5 2024-03-14
suricata ET PHISHING DHL Phishing Landing 2018-04-09 rev 2 2024-03-14
suricata ET INFO JAVA - Zip/JAR File Downloaded Possibly Containing Serialized Data by By Vulnerable Client rev 5 2024-03-14
suricata ET EXPLOIT_KIT Sweet Orange Landing with Applet Sep 30 2013 rev 9 2024-03-14
suricata ET HUNTING SUSPICIOUS Local file read using read protocol rev 3 2024-03-14
suricata ET PHISHING Generic PhishKit Author Comment M5 2018-08-30 rev 2 2024-03-14
suricata ET PHISHING Possible Chase Phishing Landing - Title over non SSL rev 5 2024-03-14