Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Sinowal/sinonet/mebroot/Torpig infected host POSTing process list rev 5 2022-05-03
suricata ET INFO Ask Webcrawler User-Agent rev 2 2022-05-03
suricata ET EXPLOIT_KIT Suspicious GitHack TLS SNI Request - Possible PurpleFox EK rev 2 2022-05-03
suricata ET PHISHING Generic Phish Landing Page 2022-01-14 rev 3 2022-05-03
snort GPL SQL user name buffer overflow attempt rev 4 2022-05-02
snort ET POLICY Pastebin-style service note .youdao .com in DNS query rev 3 2022-05-02
snort ET TROJAN TA452 Related Domain in DNS Lookup rev 2 2022-05-02
snort ET TROJAN TA452 Related Domain in DNS Lookup rev 2 2022-05-02
snort ET TROJAN TA452 Related Domain in DNS Lookup rev 2 2022-05-02
suricata ET MALWARE TA452 Related Domain in DNS Lookup rev 1 2022-05-02
suricata ET MALWARE TA452 Related Domain in DNS Lookup rev 1 2022-05-02
suricata ET MALWARE TA452 Related Domain in DNS Lookup rev 1 2022-05-02
sigma PrintBrm ZIP Creation of Extraction test 2022-05-02
sigma Gpresult Display Group Policy Information test 2022-05-01
snort ET INFO Terse Unencrypted Request for Google - Likely Connectivity Check rev 3 2022-04-29
snort ET CURRENT_EVENTS Successful IRS Credential Phish 2022-04-25 rev 3 2022-04-29
sigma Ngrok Usage with Remote Desktop Service test 2022-04-29
snort ET TROJAN [ESET] TA410 APT LookBack HTTP Server Response rev 1 2022-04-28
snort ET TROJAN MoneroOcean Installer Batch Script Inbound rev 1 2022-04-28
sigma Suspicious Files in Default GPO Folder test 2022-04-28
sigma VSSAudit Security Event Source Registration test 2022-04-28
snort ET INFO [TW] Likely Javascript-Obfuscator Usage Observed M3 rev 3 2022-04-27
snort ET INFO [TW] Likely Javascript-Obfuscator Usage Observed M2 rev 3 2022-04-27
snort ET INFO [TW] Likely Javascript-Obfuscator Usage Observed M1 rev 3 2022-04-27
snort ET INFO Terse Request For Bitbucket Snippet rev 2 2022-04-25
snort ET CURRENT_EVENTS Tech Support/Refund Scam Landing Inbound 2022/04/25 rev 1 2022-04-25
sigma Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution test 2022-04-25
sigma PowerShell WMI Win32_Product Install MSI test 2022-04-24
sigma Suspicious Get-Variable.exe Creation test 2022-04-23
snort ET TROJAN Kratos Silent Miner Checkin via Discord rev 2 2022-04-22
snort ET CURRENT_EVENTS Successful Banca Monte dei Paschi di Siena Credential Phish 2022-04-22 rev 2 2022-04-22
snort ET TROJAN 000Stealer CnC Checkin rev 2 2022-04-22
snort ET CURRENT_EVENTS Banca Monte dei Paschi di Siena Credential Phish Landing Page 2022-04-22 rev 1 2022-04-22
snort ET TROJAN 000Stealer Data Exfiltration M1 rev 2 2022-04-22
snort ET TROJAN Win32/TrojanDownloader.Agent.APBB Checkin rev 2 2022-04-22
suricata ET PHISHING Banca Monte dei Paschi di Siena Credential Phish Landing Page 2022-04-22 rev 1 2022-04-22
suricata ET PHISHING Successful Banca Monte dei Paschi di Siena Credential Phish 2022-04-22 rev 2 2022-04-22
snort ET TROJAN Arkei/Vidar/Mars Stealer Variant rev 2 2022-04-21
snort ET TROJAN Win32/ChromeBack Browser Hijacker Home Beacon rev 1 2022-04-21
suricata ET MALWARE Win32/ChromeBack Browser Hijacker Home Beacon rev 2 2022-04-21