Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Explorer NOUACCHECK Flag test 2022-04-21
sigma DLL Load via LSASS test 2022-04-21
sigma New Kind of Network (NKN) Detection test 2022-04-21
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded WebUI Login Attempt M2 rev 2 2022-04-20
snort ET TROJAN Win32/TrojanDownloader.Agent.RFS Variant Checkin rev 2 2022-04-20
sigma Suspicious Dropbox API Usage test 2022-04-20
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded Credential ConfigSyncProc System Details Request rev 2 2022-04-19
snort ET TROJAN Zingo/GinzoStealer Downloading Additional Payloads rev 2 2022-04-19
snort ET MALWARE Win/Malware.FileTour Variant Checkin rev 1 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded Credential ConfigSyncProc Login Attempt rev 2 2022-04-19
snort ET SCAN RDP Connection Attempt from Nmap rev 1 2022-04-19
snort ET TROJAN Zingo/GinzoStealer Data Exfiltration M2 rev 2 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Stack Overflow in Base64 Authorization Mechanism M1 rev 2 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded WebUI Login Attempt M1 rev 2 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC ConfigSyncProc RCE Attempt rev 1 2022-04-19
snort ET MALWARE Win/Malware.FileTour Variant Checkin rev 1 2022-04-19
snort ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Stack Overflow in Base64 Authorization Mechanism M2 rev 2 2022-04-19
suricata ET ADWARE_PUP Win/Malware.FileTour Variant Checkin rev 1 2022-04-19
suricata ET MALWARE Zingo/GinzoStealer Data Exfiltration M2 rev 1 2022-04-19
suricata ET MALWARE Zingo/GinzoStealer Downloading Additional Payloads rev 2 2022-04-19
suricata ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Stack Overflow in Base64 Authorization Mechanism M2 rev 1 2022-04-19
suricata ET SCAN RDP Connection Attempt from Nmap rev 1 2022-04-19
snort GPL NETBIOS DCERPC CoGetInstanceFromFile little endian overflow attempt rev 7 2022-04-18
snort ET CURRENT_EVENTS Successful CSIS Credential Phish rev 2 2022-04-18
snort ET WEB_SPECIFIC_APPS coRED CMS rubID Parameter SELECT FROM SQL Injection Attempt rev 4 2022-04-18
snort ET TROJAN Lyceum Golang HTTP Backdoor Submitting Data to CnC rev 2 2022-04-18
snort ET TROJAN [PTsecurity] Win32/Remcos RAT Checkin 51 rev 2 2022-04-18
snort ET CURRENT_EVENTS Successful Generic Credential Phish 2022-03-18 rev 2 2022-04-18
snort ET CURRENT_EVENTS Generic Credential Phish 2022-03-18 rev 2 2022-04-18
snort ET TROJAN HVNC USR Init Detected rev 2 2022-04-18
snort ET TROJAN Bitter RAT HTTP CnC Beacon M2 rev 3 2022-04-18
snort ET EXPLOIT Oracle WebLogic - wls-wsat Component Deserialization Remote Code Execution Windows rev 3 2022-04-18
snort ET TROJAN Avzhan DDoS Bot User-Agent MyIE rev 9 2022-04-18
snort ET CURRENT_EVENTS TodayZoo Phishing Kit GET M1 rev 2 2022-04-18
snort ET CURRENT_EVENTS TodayZoo Phishing Kit GET M2 rev 2 2022-04-18
snort ET CURRENT_EVENTS Successful TA422 Credential Phish 2022-03-17 M1 rev 2 2022-04-18
snort ET TROJAN MSIL/CoinMiner Performing System Checkin rev 3 2022-04-18
snort ET WEB_SPECIFIC_APPS Apache Struts ognl inbound OGNL injection remote code execution attempt rev 3 2022-04-18
snort ET CURRENT_EVENTS Metawallet Phish Landing Page 2022-01-13 rev 2 2022-04-18
snort ET SCAN struts-pwn User-Agent rev 2 2022-04-18