Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Lets Encrypt Free SSL Cert Observed with IDN/Punycode Domain - Possible Phishing rev 5 2024-03-07
suricata ET MALWARE REvil Exfil SFTP Certificate Inbound rev 2 2024-03-07
suricata ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt rev 7 2024-03-07
suricata ET MOBILE_MALWARE Android Golden Rat Checkin rev 2 2024-03-07
suricata ET PHISHING Team IPwned Phishing Landing 2016-08-24 rev 5 2024-03-07
suricata ET PHISHING Adobe Shared Document Phishing Landing 2016-08-30 rev 4 2024-03-07
suricata ET P2P Soulseek Filesearch Results rev 7 2024-03-07
suricata ET MALWARE Dialer.Trojan Activity rev 7 2024-03-07
suricata ET PHISHING Amazon Phish Landing Jun 22 2017 rev 5 2024-03-07
suricata ET MALWARE CobianRAT Screenshot Exfil to CnC rev 3 2024-03-07
suricata ET MALWARE ELF/Emptiness v2 XOR DNS Flood Command Inbound rev 2 2024-03-07
suricata ET PHISHING Successful CIBC Phish 2016-08-30 rev 4 2024-03-07
suricata ET MALWARE Locky Ransomware Renaming File via SMB rev 2 2024-03-07
suricata ET EXPLOIT Possible ECLIPSEDWING MS08-067 rev 2 2024-03-07
suricata ET PHISHING Successful Apple Phish 2016-03-09 rev 5 2024-03-07
suricata ET PHISHING Successful Chase Phish M1 2016-08-26 rev 4 2024-03-07
suricata ET PHISHING Successful Craigslist Phish 2016-07-11 rev 7 2024-03-07
suricata ET EXPLOIT_KIT RIG EK - Unexpected Victim Location Server Response rev 4 2024-03-07
suricata ET EXPLOIT AVTECH Authenticated Command Injection in adcommand.cgi rev 3 2024-03-07
suricata ET PHISHING Successful OWA Account Phish 2015-08-21 rev 5 2024-03-07
suricata ET P2P Morpheus Update Request rev 12 2024-03-07
suricata ET PHISHING Successful Dropbox Phish 2015-12-10 rev 5 2024-03-07
suricata ET PHISHING Successful Horde Webmail Phish 2015-08-21 rev 5 2024-03-07
suricata ET EXPLOIT Possible ETERNALBLUE Exploit M3 MS17-010 rev 4 2024-03-07
suricata ET PHISHING Email Settings Error Phishing Landing Nov 16 2016 rev 5 2024-03-07
suricata ET PHISHING Successful Maersk Phishing 2016-02-25 rev 6 2024-03-07
suricata ET EXPLOIT ETERNALBLUE Probe Vulnerable System Response MS17-010 rev 4 2024-03-07
suricata ET MALWARE ELF/Emptiness v2 XOR Exec Command Inbound rev 2 2024-03-07
suricata ET INFO Dameware Remote Control Service Install rev 6 2024-03-07
suricata ET PHISHING Successful Blocked Email Account Phish M2 2016-08-23 rev 4 2024-03-07
suricata ET EXPLOIT Pwdump3e Session Established Reg-Entry port 445 rev 9 2024-03-07
suricata ET MALWARE Pteranodon Backdoor CnC POST rev 4 2024-03-07
suricata ET PHISHING Phishing Landing via Weebly.com M3 2016-02-02 rev 6 2024-03-07
suricata ET WEB_SERVER Possible Apache Struts OGNL Expression Injection rev 4 2024-03-07
suricata ET PHISHING Successful Wells Fargo Phish Loading Page 2016-01-07 rev 4 2024-03-07
suricata ET PHISHING Webmail Validator Phishing Landing 2016-09-02 rev 4 2024-03-07
suricata ET PHISHING Mailbox Update Phishing Landing M2 2016-05-16 rev 4 2024-03-07
suricata ET VOIP H.323 in Q.931 Call Setup - Inbound rev 2 2024-03-07
suricata ET EXPLOIT Pwdump3e pwservice.exe Access port 445 rev 10 2024-03-07
suricata ET PHISHING Successful Chase Phishing 2016-12-12 rev 5 2024-03-07