Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Win32/CryptFile2 Ransomware Checkin M2 rev 5 2024-03-11
suricata ET MALWARE [ANY.RUN] Xeno-RAT TCP Check-In rev 3 2024-03-11
suricata ET MALWARE Fake Opera 8.11 UA related to Trojan Activity rev 5 2024-03-11
suricata ET INFO python.urllib User Agent Web Crawl rev 12 2024-03-11
sigma External Remote RDP Logon from Public IP test 2024-03-11
sigma Remote Access Tool - Team Viewer Session Started On Linux Host test 2024-03-11
sigma Remote Access Tool - Team Viewer Session Started On MacOS Host test 2024-03-11
sigma Failed Logon From Public IP test 2024-03-11
sigma External Remote SMB Logon from Public IP test 2024-03-11
sigma Renamed NirCmd.EXE Execution test 2024-03-11
sigma Remote Access Tool - Team Viewer Session Started On Windows Host test 2024-03-11
suricata ET MALWARE FrauDrop UA LETITGO rev 4 2024-03-10
suricata ET MALWARE Observed Win32/CollectorStealer User-Agent M1 rev 2 2024-03-10
suricata ET SCAN Absinthe SQL Injection Tool HTTP Header Detected rev 9 2024-03-10
suricata ET MALWARE Hoax.Win32.BadJoke/DownLoader1.57593 Checkin rev 5 2024-03-10
suricata ET WEB_SERVER AntSword Webshell Commands Inbound rev 3 2024-03-10
suricata ET MALWARE Likseput.B Checkin rev 6 2024-03-10
suricata ET MALWARE W32/ServStart.Variant CnC Beacon rev 4 2024-03-10
suricata ET MALWARE FrauDrop UA single rev 4 2024-03-10
suricata ET MALWARE Umbra/MultiBot Plugin access rev 5 2024-03-10
suricata ET INFO Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile rev 9 2024-03-10
suricata ET INFO SUSPICIOUS UA starting with Mozilla/0 rev 4 2024-03-10
suricata ET INFO VMware User-Agent Outbound rev 7 2024-03-10
suricata ET MALWARE W32/Badur.Spy User Agent lawl rev 6 2024-03-10
suricata ET MALWARE Observed Win32/CollectorStealer User-Agent M2 rev 3 2024-03-10
suricata ET MALWARE EtumBot Registration Request rev 8 2024-03-10
suricata ET MALWARE Fake/Short Google Search Appliance UA Win32/Ranbyus and Others rev 5 2024-03-10
suricata ET MALWARE AntSword Webshell User-Agent Observed rev 3 2024-03-10
suricata ET INFO Outbound HTTP Connection From Cisco IOS Device rev 5 2024-03-10
suricata ET SCAN ZmEu Scanner User-Agent Inbound rev 5 2024-03-10
suricata ET MALWARE FakeAV Win32/Antivirus2008 CnC Beacon rev 10 2024-03-10
suricata ET MALWARE Likely Infected HTTP POST to PHP with User-Agent of HTTP Client rev 5 2024-03-10
suricata ET MALWARE W32/Armageddon CnC Checkin rev 4 2024-03-10
snort ET TROJAN TA399/SideWinder Related Backdoor Activity rev 1 2024-03-08
snort ET TROJAN Magnet Goblin Linux Nerbian RAT Trigger Sequence from CnC Server rev 1 2024-03-08
suricata GPL WEB_SERVER writeto.cnf access rev 14 2024-03-08
suricata ET MALWARE Agrius Group Webshell Command Execution Attempt rev 2 2024-03-08
suricata GPL MISC CVS non-relative path error response rev 6 2024-03-08
suricata GPL WEB_SERVER viewcode access rev 13 2024-03-08
suricata GPL EXPLOIT xp_sprintf possible buffer overflow rev 11 2024-03-08