Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Successful Mailbox Shutdown Phish M3 2016-05-16 rev 5 2024-03-07
suricata ET DOS Excessive Large Tree Connect Response rev 4 2024-03-07
suricata ET EXPLOIT_KIT RIG EK - Unexpected Victim Location Server Response rev 4 2024-03-07
suricata ET MALWARE [Fireeye] Backdoor.BEACON M4 rev 3 2024-03-07
suricata ET EXPLOIT Pwdump3e Session Established Reg-Entry port 445 rev 9 2024-03-07
suricata ET MALWARE ELF/Emptiness v2 XOR DNS Flood Command Inbound rev 2 2024-03-07
suricata ET PHISHING Am3Refh Obfuscated Phishing Landing 2016-02-23 rev 5 2024-03-07
suricata ET PHISHING [eSentire] Successful 163 Webmail Phish 2018-07-25 rev 5 2024-03-07
suricata ET PHISHING Successful Generic 000webhostapp.com Phish 2017-10-27 rev 6 2024-03-07
suricata ET MALWARE CobianRAT Screenshot Exfil to CnC rev 3 2024-03-07
suricata ET PHISHING Avast Phishing Landing 2016-06-02 rev 4 2024-03-07
suricata ET PHISHING Generic NewInjection Phishing Landing 2021-03-10 rev 3 2024-03-07
suricata ET PHISHING Possible Successful Bank of America Phishing Domain Feb 02 2017 rev 5 2024-03-07
suricata ET MALWARE FastPOS RAM Scraper Sending Details rev 4 2024-03-07
suricata ET PHISHING Successful Chase Phishing 2016-12-12 rev 5 2024-03-07
suricata ET PHISHING Observed UK Gov Support Landing 2021-06-01 rev 2 2024-03-07
suricata ET MALWARE Win32/BlackCarat Response from CnC rev 3 2024-03-07
suricata ET ADWARE_PUP Clickspring.net Spyware Reporting rev 11 2024-03-07
suricata ET PHISHING Possible Ebay Phishing Domain Jan 30 2017 rev 5 2024-03-07
suricata ET EXPLOIT AVTECH Authenticated Command Injection in adcommand.cgi rev 3 2024-03-07
suricata ET PHISHING Phishing Landing via Weebly.com M2 2016-02-02 rev 6 2024-03-07
suricata ET PHISHING Google Drive Phishing Landing 2016-08-25 rev 4 2024-03-07
suricata ET PHISHING Successful Apple Phish 2016-03-09 rev 5 2024-03-07
suricata ET HUNTING Possible Covid19 Themed Email Spam Outbound M5 rev 3 2024-03-07
suricata ET PHISHING Successful Craigslist Phish 2016-07-11 rev 7 2024-03-07
suricata ET EXPLOIT ThinkPHP Attempted Bypass and Payload Retrieval rev 3 2024-03-07
suricata ET EXPLOIT Possible Oracle Identity Manager Attempt to Logon with default account rev 5 2024-03-07
suricata ET ADWARE_PUP LNKR Possible Response for LNKR js file rev 7 2024-03-07
suricata ET INFO Base64 Encoded powershell.exe in HTTP Response M2 rev 5 2024-03-07
suricata ET MALWARE HTML/Xbash Hex Encoded PS WebClient Object Inbound - Stage 1 rev 3 2024-03-07
suricata ET PHISHING Successful Webmail Validator Phish M2 2016-09-02 rev 4 2024-03-07
suricata ET MALWARE Dialer.Trojan Activity rev 7 2024-03-07
suricata ET PHISHING Successful Maersk Phishing 2016-02-25 rev 6 2024-03-07
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle USAToday Server] rev 4 2024-03-07
suricata ET MALWARE Wide HTA with PowerShell Execution Inbound rev 4 2024-03-07
suricata ET EXPLOIT TP-Link Technologies TL-WA850RE Wi-Fi Range Extender - Command Execution rev 4 2024-03-07
suricata ET INFO Logmein.com/Join.me SSL Remote Control Access rev 5 2024-03-07
suricata ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt rev 7 2024-03-07
suricata ET INFO IP Logger Redirect Domain in SNI rev 4 2024-03-07
suricata ET EXPLOIT Possible CVE-2016-10033 PHPMailer RCE Attempt rev 4 2024-03-07