Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE PoshC2 - Observed Default URI Structure M11 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M30 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M9 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M16 rev 2 2022-05-06
sigma Raspberry Robin Subsequent Execution of Commands test 2022-05-06
sigma Raspberry Robin Initial Execution From External Drive test 2022-05-06
snort ET INFO [TW] Internet Computer HTTP Request Observed rev 1 2022-05-05
snort ET INFO [TW] Internet Computer HTTP Referer Observed rev 1 2022-05-05
snort ET INFO [TW] Internet Computer Domain Observed rev 1 2022-05-05
snort ET INFO [TW] Internet Computer HTTP Location Redirect Observed rev 1 2022-05-05
suricata ET HUNTING [TW] Internet Computer HTTP Request Observed rev 1 2022-05-05
suricata ET PHISHING Successful Survey Credential Phish M1 2022-04-04 rev 2 2022-05-05
suricata ET HUNTING [TW] Internet Computer Domain Observed rev 1 2022-05-05
suricata ET HUNTING [TW] Internet Computer HTTP Referer Observed rev 1 2022-05-05
suricata ET PHISHING Successful Survey Credential Phish M2 2022-04-04 rev 2 2022-05-05
suricata ET PHISHING Successful Survey Credential Phish M3 2022-04-04 rev 2 2022-05-05
suricata ET HUNTING [TW] Internet Computer HTTP Location Redirect Observed rev 1 2022-05-05
snort ET CURRENT_EVENTS Successful Survey Credential Phish M1 2022-04-04 rev 2 2022-05-04
snort ET CURRENT_EVENTS Survey Credential Phish Landing Page 2022-04-04 rev 1 2022-05-04
snort ET CURRENT_EVENTS Successful Survey Credential Phish M5 2022-04-04 rev 2 2022-05-04
snort ET CURRENT_EVENTS Successful Survey Credential Phish M4 2022-04-04 rev 2 2022-05-04
snort ET CURRENT_EVENTS Successful Survey Credential Phish M2 2022-04-04 rev 2 2022-05-04
snort ET CURRENT_EVENTS Successful Survey Credential Phish M6 2022-04-04 rev 2 2022-05-04
snort ET CURRENT_EVENTS Successful Survey Credential Phish M3 2022-04-04 rev 2 2022-05-04
snort ET CURRENT_EVENTS Successful Survey Credential Phish M7 2022-04-04 rev 2 2022-05-04
suricata ET PHISHING Survey Credential Phish Landing Page 2022-04-04 rev 1 2022-05-04
suricata ET PHISHING Successful Survey Credential Phish M6 2022-04-04 rev 2 2022-05-04
suricata ET PHISHING Successful Survey Credential Phish M5 2022-04-04 rev 1 2022-05-04
suricata ET PHISHING Successful Survey Credential Phish M7 2022-04-04 rev 2 2022-05-04
suricata ET PHISHING Successful Survey Credential Phish M4 2022-04-04 rev 2 2022-05-04
snort ET CHAT IRC PONG response rev 19 2022-05-03
snort ET EXPLOIT CVE-2016-0189 Common Construct M1 rev 2 2022-05-03
snort ET DOS Excessive Large Tree Connect Response rev 3 2022-05-03
snort ET TROJAN Towerweb Ransomware Landing Page rev 3 2022-05-03
snort ET WEB_SPECIFIC_APPS Joomla com_videogallery controller parameter Local File Inclusion Attempt rev 4 2022-05-03
snort ET CURRENT_EVENTS [PTsecurity] Grandsoft EK Payload rev 3 2022-05-03
snort ET WEB_SERVER MSSQL Server OLEDB asp error rev 13 2022-05-03
snort ET CURRENT_EVENTS Successful Banco do Brasil Phish Mar 30 2017 rev 3 2022-05-03
snort ET WEB_CLIENT Malicious SCF File Inbound rev 2 2022-05-03
snort ET CURRENT_EVENTS DRIVEBY [PwC CTD] -- MultiGroup - ScanBox and Targetted Watering Holes ActiveX Call rev 3 2022-05-03