Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Win32/NetDooka Framework RAT Sending File rev 6 2024-03-14
suricata ET PHISHING Generic PhishKit Author Comment M4 2018-08-30 rev 2 2024-03-14
suricata ET MALWARE Parallax CnC Response Activity M7 rev 3 2024-03-14
suricata GPL NETBIOS SMB-DS llsrpc bind attempt rev 5 2024-03-14
suricata GPL NETBIOS SMB-DS msqueue unicode bind attempt rev 5 2024-03-14
suricata ET MALWARE Drovorub monitor Module Server Response rev 3 2024-03-14
suricata GPL NETBIOS SMB-DS msqueue little endian bind attempt rev 5 2024-03-14
suricata ET PHISHING Badoo Phishing Landing 2018-07-19 rev 4 2024-03-14
suricata ET EXPLOIT_KIT Possible Evil Redirector Leading to EK June 10 2015 rev 13 2024-03-14
suricata ET MALWARE Drovorub cloud.auth Module Server Response rev 2 2024-03-14
suricata ET PHISHING Sparkasse Phishing Landing 2018-02-15 rev 2 2024-03-14
suricata ET PHISHING Paypal Phishing Landing 2018-01-31 rev 2 2024-03-14
suricata ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation - Responding with Superuser Credentials rev 2 2024-03-14
suricata ET PHISHING Microsoft Questionnaire Phishing Landing 2018-01-19 rev 2 2024-03-14
suricata ET WEB_CLIENT Malicious SCF File Inbound rev 4 2024-03-14
suricata ET EXPLOIT Possible SAP NetWeaver CVE-2020-6287 Exploit Success rev 3 2024-03-14
suricata ET MALWARE KL-Remote / Cryp_Banker14 RAT response rev 4 2024-03-14
suricata ET INFO JAVA - Java Serialized Data Download rev 6 2024-03-14
suricata ET PHISHING Generic PhishKit Author Comment M2 2018-08-30 rev 2 2024-03-14
suricata ET MALWARE PE EXE or DLL Windows file download Text M2 rev 3 2024-03-14
suricata ET MALWARE DarkComet-RAT init connection rev 6 2024-03-14
suricata ET PHISHING Dropbox Phishing Landing 2018-08-30 rev 2 2024-03-14
suricata ET EXPLOIT_KIT Spelevo EK Landing M2 rev 2 2024-03-14
suricata ET EXPLOIT_KIT Sundown EK Secondary Landing Apr 20 2015 rev 4 2024-03-14
suricata ET PHISHING Dropbox 000webhost Phishing Landing 2018-04-19 rev 2 2024-03-14
suricata GPL NETBIOS DCERPC IActivation little endian bind attempt rev 4 2024-03-14
suricata ET WEB_CLIENT pshell dl/execute primitives in wideb64 6 rev 2 2024-03-14
suricata ET MALWARE Likely Trojan Multi-part Macro Download M1 rev 4 2024-03-14
suricata ET EXPLOIT Ecessa WANWorx WVR-30 Cross-Site Request Forgery rev 2 2024-03-14
suricata ET EXPLOIT_KIT DRIVEBY Sednit EK IE Exploit CVE-2013-1347 M1 rev 4 2024-03-14
suricata ET EXPLOIT_KIT Probable Sakura Java applet with obfuscated URL Sep 21 2012 rev 5 2024-03-14
suricata GPL NETBIOS SMB irot unicode bind attempt rev 5 2024-03-14
suricata ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL rev 3 2024-03-14
suricata ET INFO SMB Executable File Transfer rev 3 2024-03-14
suricata GPL NETBIOS SMB-DS IActivation unicode bind attempt rev 5 2024-03-14
suricata ET MALWARE Magniber Ransomware Retrieving Instructions rev 2 2024-03-14
suricata ET CHAT IRC USER command rev 18 2024-03-14
suricata ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response rev 3 2024-03-14
suricata ET HUNTING [TW] Likely Hex Executable String rev 2 2024-03-14
suricata ET MALWARE SharpNoPSExec EXE Lateral Movement Tool Downloaded rev 3 2024-03-14