Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Facebook Credential Phish Landing Page M2 2022-08-01 rev 1 2022-10-03
suricata ET PHISHING Generic Credential Phish Landing Page 2022-07-26 rev 1 2022-10-03
suricata ET PHISHING Facebook Credential Phish Landing Page 2022-08-22 rev 1 2022-10-03
suricata ET PHISHING Successful Generic Credential Phish 2022-08-23 rev 1 2022-10-03
suricata ET PHISHING Generic Credential Phish Landing Page 2022-10-03 rev 1 2022-10-03
sigma Use of UltraVNC Remote Access Software test 2022-10-02
sigma Suspicious Execution of Shutdown to Log Out test 2022-10-01
sigma Chopper Webshell Process Pattern test 2022-10-01
sigma Suspicious ASPX File Drop by Exchange test 2022-10-01
snort ET INFO 404 Response with Javascript Variable in Page rev 1 2022-09-30
snort ET TROJAN Havoc Framework CnC Request rev 1 2022-09-30
snort ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.aam CnC Domain in DNS Lookup rev 1 2022-09-30
snort ET TROJAN Havoc Framework CnC Response rev 1 2022-09-30
snort ET TROJAN WP CharCode Inject rev 1 2022-09-30
suricata ET MALWARE WP CharCode Inject rev 1 2022-09-30
snort ET TROJAN Win32/NetDooka Framework RAT Sending Session ID rev 4 2022-09-29
snort ET TROJAN TA444 Domain in DNS Lookup rev 1 2022-09-29
snort ET TROJAN Win32/NetDooka Framework RAT Sending File rev 5 2022-09-29
snort ET TROJAN TA444 Domain in DNS Lookup rev 1 2022-09-29
suricata ET MALWARE TA444 Domain in DNS Lookup rev 1 2022-09-29
suricata ET MALWARE TA444 Domain in DNS Lookup rev 1 2022-09-29
snort ET CURRENT_EVENTS Successful TA399/Sidewinder Related Phish 2022-09-28 rev 1 2022-09-28
snort ET TROJAN TigerHunter DOTM CnC Checkin rev 1 2022-09-28
snort ET CURRENT_EVENTS Successful Generic Credential Phish rev 1 2022-09-28
suricata ET MALWARE TigerHunter DOTM CnC Checkin rev 1 2022-09-28
sigma Microsoft Defender Blocked from Loading Unsigned DLL test 2022-09-28
sigma Potential Invoke-Mimikatz PowerShell Script test 2022-09-28
sigma Unsigned Binary Loaded From Suspicious Location test 2022-09-28
snort ET TROJAN Win32/SaintStealer CnC Response rev 1 2022-09-27
snort ET TROJAN Win32/Wacapew.C!ml CnC Checkin rev 1 2022-09-27
suricata ET MALWARE Win32/SaintStealer CnC Response rev 1 2022-09-27
suricata ET MALWARE Win32/Wacapew.C!ml CnC Checkin rev 1 2022-09-27
sigma Wab/Wabmig Unusual Parent Or Child Processes test 2022-09-27
sigma Remote File Download Via Desktopimgdownldr Utility test 2022-09-27
sigma Unusual File Modification by dns.exe test 2022-09-27
sigma Wab Execution From Non Default Location test 2022-09-27
sigma Potential Bumblebee Remote Thread Creation test 2022-09-27
sigma UAC Bypass via Windows Firewall Snap-In Hijack test 2022-09-27
sigma UAC Bypass via ICMLuaUtil test 2022-09-27
sigma Potential Remote Desktop Tunneling test 2022-09-27