Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Google Drive Phishing Landing Nov 6 2015 M2 rev 5 2024-03-14
suricata ET MALWARE Win32/NetDooka Framework RAT Sending Session ID rev 4 2024-03-14
suricata ET PHISHING Wells Fargo Phishing Landing 2018-02-02 M1 rev 3 2024-03-14
suricata ET PHISHING Possible Fedex Phishing Landing 2015-07-28 rev 5 2024-03-14
suricata ET PHISHING Post.ch Cloned Phishing Landing 2018-04-09 rev 2 2024-03-14
suricata ET PHISHING Bank of America Phishing Landing 2018-01-18 M1 rev 2 2024-03-14
suricata ET PHISHING Possible Apple Store Phish Landing 2015-07-30 rev 5 2024-03-14
suricata ET PHISHING Facebook Phishing Landing 2018-01-23 rev 2 2024-03-14
suricata ET PHISHING Possible Successful Apple Phish 2015-07-27 rev 4 2024-03-14
suricata ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL rev 4 2024-03-14
suricata GPL NETBIOS SMB-DS winreg little endian bind attempt rev 5 2024-03-14
suricata ET INFO ATF file in HTTP Flowbit Set rev 4 2024-03-14
suricata ET EXPLOIT_KIT Likely Evil JS used in Unknown EK Landing rev 5 2024-03-14
suricata ET HUNTING SUSPICIOUS .LNK File Inside of Zip rev 2 2024-03-14
suricata ET EXPLOIT_KIT SunDown EK RIP Landing M4 B641 rev 3 2024-03-14
suricata GPL NETBIOS SMB DCERPC LSASS bind attempt rev 10 2024-03-14
suricata ET MALWARE MSIL/Agent.TRM Task Command rev 2 2024-03-14
suricata ET PHISHING Possible Google Drive/Dropbox Phishing Landing Jul 10 2015 rev 4 2024-03-14
suricata ET EXPLOIT_KIT SNET EK Encoded VBS 3 rev 4 2024-03-14
suricata ET WEB_CLIENT Generic Fake Support Phone Scam Mar 8 rev 4 2024-03-14
suricata ET EXPLOIT Possible MeltDown PoC Download In Progress rev 3 2024-03-14
suricata ET PHISHING Wells Fargo Phishing Landing 2018-02-02 M7 rev 2 2024-03-14
suricata GPL NETBIOS SMB llsrpc unicode bind attempt rev 5 2024-03-14
suricata ET PHISHING Free Mobile Phishing Landing 2018-08-07 rev 2 2024-03-14
suricata GPL NETBIOS SMB-DS msqueue unicode little endian bind attempt rev 5 2024-03-14
suricata ET PHISHING Smartsheet Phishing Landing 2018-01-29 rev 3 2024-03-14
suricata ET MALWARE Likely Malicious Windows SCT Download MSXMLHTTP AX M2 rev 3 2024-03-14
suricata ET EXPLOIT_KIT EITest SocENG Inject M2 rev 4 2024-03-14
suricata GPL NETBIOS SMB-DS ISystemActivator unicode little endian bind attempt rev 5 2024-03-14
suricata ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL rev 3 2024-03-14
suricata ET PHISHING Dropbox Shared Document Phishing Landing Feb 21 2017 rev 3 2024-03-14
suricata ET MALWARE Possible Office Doc with Embedded VBA containing Reverse Meterpreter Shell rev 3 2024-03-14
suricata ET EXPLOIT_KIT MWI Maldoc Exploit Kit Stats Callout rev 3 2024-03-14
suricata ET MALWARE Possible click2play bypass Oct 19 2015 as observed in PawnStorm rev 5 2024-03-14
suricata ET EXPLOIT Possible Android Stagefright MP4 CVE-2015-1538 - ROP rev 3 2024-03-14
suricata ET PHISHING Netflix Phishing Landing 2017-07-20 rev 2 2024-03-14
suricata GPL NETBIOS SMB ISystemActivator little endian bind attempt rev 5 2024-03-14
suricata ET MALWARE Possible AMSI Powershell Bypass Attempt B643 rev 3 2024-03-14
suricata ET EXPLOIT_KIT RedKit applet + obfuscated URL Apr 7 2013 rev 4 2024-03-14
suricata ET PHISHING Wells Fargo Phishing Landing 2018-02-22 rev 2 2024-03-14