Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata GPL NETBIOS SMB-DS DCERPC ISystemActivator unicode bind attempt rev 10 2024-03-14
suricata ET INFO Possible SSLv2 Negotiation in Progress Client Master Key SSL2_RC2_128_CBC_EXPORT40_WITH_MD5 rev 3 2024-03-14
suricata ET MALWARE Netwire RAT Check-in 2 rev 3 2024-03-14
suricata ET MALWARE Possible malicious Office doc hidden in XML file rev 3 2024-03-14
suricata ET PHISHING AT&T Phishing Landing 2018-08-30 rev 3 2024-03-14
suricata ET EXPLOIT_KIT SunDown EK RIP Landing M1 B641 rev 3 2024-03-14
suricata ET MALWARE Possible Inbound PowerShell via Invoke-PSImage Stego rev 3 2024-03-14
suricata ET MALWARE PawnStorm Java Class Stage 1 M1 Aug 28 2015 rev 3 2024-03-14
suricata ET MALWARE Parallax CnC Response Activity M6 rev 2 2024-03-14
suricata ET PHISHING DHL Phish Landing 2015-11-14 rev 5 2024-03-14
sigma Remote Access Tool - UltraViewer Execution test 2024-03-14
snort ET TROJAN TA416 Related PUBLOAD Variant Checkin Activity M2 rev 1 2024-03-13
snort ET TROJAN DaoDao Cloud Loader C2 Response rev 1 2024-03-13
snort ET TROJAN Win32/Spyder CnC Checkin rev 2 2024-03-13
snort ET TROJAN Win32/Spyder Sending Info to CnC rev 2 2024-03-13
suricata ET EXPLOIT_KIT DRIVEBY SPL - Landing Page Received rev 7 2024-03-13
suricata ET WEB_CLIENT DRIVEBY Redirection - Wordpress Injection rev 3 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Mozilla JS Class Creation rev 4 2024-03-13
suricata ET INFO JAVA - document.createElement applet rev 3 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdSave Method Access Buffer Overflow rev 5 2024-03-13
suricata ET EXPLOIT_KIT DRIVEBY Java Atomic Exploit Downloaded rev 7 2024-03-13
suricata ET INFO PDF /FlateDecode and PDF version 1.0 rev 4 2024-03-13
suricata ET EXPLOIT_KIT DRIVEBY Styx - TDS - Redirect To Landing Page rev 4 2024-03-13
suricata ET MOBILE_MALWARE Android.KorBanker Successful Fake Banking App Install CnC Server Acknowledgement rev 4 2024-03-13
suricata ET HUNTING PDF Containing Subform with JavaScript rev 7 2024-03-13
suricata ET WEB_SERVER WebShell Generic eval of str_rot13 rev 9 2024-03-13
suricata ET HUNTING Suspicious Possible CollectGarbage in base64 2 rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS .CPL File Inside of Zip rev 4 2024-03-13
suricata ET MALWARE Hoic.zip retrieval rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS Word DOCX with Many ActiveX Objects and Media rev 7 2024-03-13
suricata ET ACTIVEX Possible LEADTOOLS ActiveX Raster Twain AppName Method Access Buffer Overflow 2 rev 5 2024-03-13
suricata ET EXPLOIT Possible 2012-1533 altjvm RCE via JNLP command injection rev 4 2024-03-13
suricata ET ACTIVEX Possible SkinCrafter ActiveX Control InitLicenKeys Method Access Buffer Overflow rev 6 2024-03-13
suricata ET INFO PDF - Acrobat Enumeration - var PDFObject rev 3 2024-03-13
suricata ET SHELLCODE Possible Backslash Escaped UTF-8 0c0c Heap Spray rev 3 2024-03-13
suricata ET ACTIVEX Possible Sony PC Companion Admin_RemoveDirectory Stack-based Unicode Buffer Overload SEH rev 4 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated Eval String 5 rev 4 2024-03-13
suricata ET EXPLOIT_KIT KaiXin Exploit Kit Landing Page NOP String rev 4 2024-03-13
suricata ET ACTIVEX Possible Aloaha PDF Crypter activex SaveToFile method arbitrary file overwrite rev 4 2024-03-13
suricata ET MALWARE Possible WEBC2-GREENCAT Response - Embedded CnC APT1 Related rev 4 2024-03-13