Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Account Update Phishing Landing 2016-09-06 rev 4 2024-03-07
suricata ET PHISHING Possible Successful Google Drive Phishing Domain Feb 02 2017 rev 5 2024-03-07
suricata ET WEB_SPECIFIC_APPS Apache Struts inbound .getWriter OGNL injection remote code execution attempt rev 3 2024-03-07
suricata ET ADWARE_PUP BInet Information Upload rev 12 2024-03-07
suricata ET PHISHING Possible Chase Phishing Domain Mar 14 2016 rev 7 2024-03-07
suricata ET ADWARE_PUP Regnow.com Access rev 12 2024-03-07
suricata ET MALWARE BandarChor/CryptON Ransomware Checkin rev 3 2024-03-07
suricata ET PHISHING Redirect to Adobe Shared Document Phishing M3 2016-04-18 rev 11 2024-03-07
suricata ET HUNTING Possibly Suspicious Request for Putty.exe from Non-Standard Download Location rev 4 2024-03-07
suricata ET EXPLOIT Mi Router 3 Remote Code Execution CVE-2018-13023 rev 3 2024-03-07
suricata ET MALWARE Possible Pipka JS Skimmer - Skimmer Payload Observed M2 rev 3 2024-03-07
suricata ET EXPLOIT Possible Telerik UI CVE-2019-18935 File Upload Attempt M1 rev 3 2024-03-07
suricata ET PHISHING Successful Adobe Shared Document Phish 2016-08-26 rev 5 2024-03-07
suricata ET INFO Inbound PowerShell Capable of Enumerating Internal Network via WMI rev 4 2024-03-07
suricata ET WEB_CLIENT Tech Support Phone Scam Landing Jun 29 M3 rev 5 2024-03-07
suricata ET PHISHING Mailbox Update Phishing Landing M1 2016-05-16 rev 4 2024-03-07
suricata ET PHISHING Synchronize Email Account Phishing Landing 2016-07-15 rev 4 2024-03-07
suricata ET WEB_CLIENT Tech Support Phone Scam Landing M1 2016-08-12 rev 4 2024-03-07
suricata ET EXPLOIT_KIT EITest SocEng Inject Jan 15 2017 EXE Download rev 5 2024-03-07
suricata ET PHISHING Possible Successful Craigslist Phishing Domain Feb 07 2017 rev 5 2024-03-07
suricata ET ADWARE_PUP Tibsystems Spyware Download rev 12 2024-03-07
suricata ET MALWARE Possible Pipka JS Skimmer - Skimmer Payload Observed M1 rev 3 2024-03-07
suricata ET PHISHING 401TRG Successful Multi-Email Phish - Observed in Docusign/Dropbox/Onedrive/Gdrive Nov 02 2017 rev 4 2024-03-07
suricata ET WEB_CLIENT Microsoft Tech Support Scam M2 2016-09-15 rev 4 2024-03-07
suricata ET ADWARE_PUP Media Pass ActiveX Install rev 10 2024-03-07
suricata ET ATTACK_RESPONSE Possibly Malicious VBS Writing to Persistence Registry Location rev 6 2024-03-07
suricata ET PHISHING TeamIPwned/Hellion Phishing Landing 2016-08-30 rev 4 2024-03-07
suricata ET MALWARE IcedID CnC Domain in SNI rev 2 2024-03-07
suricata ET PHISHING Anonisma Phishing CSS 2015-12-29 rev 5 2024-03-07
suricata ET MALWARE MRCR1 Ransomware Checkin M2 rev 4 2024-03-07
suricata ET HUNTING Redirect to Joom AG Hosted Document - Potential Phishing rev 3 2024-03-07
suricata ET ADWARE_PUP Outerinfo.com Spyware Activity rev 11 2024-03-07
suricata ET PHISHING Successful Webmail Account Upgrade Phish 2016-07-21 rev 6 2024-03-07
suricata ET PHISHING Possible Phishing Landing via Moonfruit M1 2016-10-03 rev 4 2024-03-07
suricata ET PHISHING Generic Email Login Phishing Landing 2016-06-02 rev 4 2024-03-07
suricata ET PHISHING Anonisma Paypal Phishing Uri Structure 2015-12-29 rev 7 2024-03-07
suricata ET EXPLOIT Possible ETERNALCHAMPION MS17-010 Sync Response rev 6 2024-03-07
suricata ET EXPLOIT Pwdump3e Password Hash Retrieval port 445 rev 12 2024-03-07
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES Server] rev 4 2024-03-07
suricata ET MOBILE_MALWARE Android Trojan Cloudsota HTTP Host rev 4 2024-03-07