Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Request for Possible Outlook Phishing Hosted on Github.io rev 4 2022-03-24
suricata ET MALWARE RedControle Communicating with CnC rev 4 2022-03-24
suricata ET PHISHING Request for Possible Adobe Phishing Hosted on Github.io rev 8 2022-03-24
suricata ET EXPLOIT D-Link Router DNS Changer Exploit Attempt rev 4 2022-03-24
suricata ET PHISHING Request for Possible Binance Phishing Hosted on Github.io rev 4 2022-03-24
suricata ET MALWARE MuddyWater Payload Sending Screenshot to CnC rev 4 2022-03-24
suricata ET EXPLOIT Possible GoldenPac Priv Esc in-use rev 4 2022-03-24
suricata ET EXPLOIT FatPipe Unrestricted File Upload rev 3 2022-03-24
suricata ET PHISHING Request for Possible Account Phishing Hosted on Github.io rev 4 2022-03-24
suricata ET PHISHING Request for Possible Paypal Phishing Hosted on Github.io rev 5 2022-03-24
suricata ET MALWARE [Fireeye] Backdoor.SUNBURST HTTP Request to avsvmcloud .com rev 4 2022-03-24
suricata ET PHISHING Request for Possible DHL Phishing Hosted on Github.io rev 4 2022-03-24
suricata ET PHISHING Generic Banking Phish Landing Page 2022-01-11 rev 3 2022-03-24
sigma Multifactor Authentication Denied test 2022-03-24
sigma Service Installation with Suspicious Folder Pattern test 2022-03-24
sigma Wannacry Killswitch Domain test 2022-03-24
snort ET TROJAN Send-Safe Bulk Mailer SSL Cert - Observed in Spam Campaigns rev 2 2022-03-23
snort ET TROJAN Spora Ransomware SSL Certificate Detected rev 2 2022-03-23
snort ET POLICY DropBox User Content Access over SSL rev 7 2022-03-23
snort ET POLICY Remote Access - RView - SSL Certificate Seen rev 2 2022-03-23
suricata ET INFO DropBox User Content Access over SSL rev 7 2022-03-23
suricata ET MALWARE Spora Ransomware SSL Certificate Detected rev 3 2022-03-23
suricata ET INFO Remote Access - RView - SSL Certificate Seen rev 3 2022-03-23
snort ET MALWARE AllaKore RAT Set Keep-Alive Observed rev 2 2022-03-22
snort ET MALWARE AllaKore RAT ID Command Observed rev 2 2022-03-22
snort ET TROJAN SUR SSL Cert APT1 rev 5 2022-03-22
snort ET TROJAN SWORD Sending Sword Marker rev 3 2022-03-22
suricata ET MALWARE SUR SSL Cert APT1 rev 5 2022-03-22
suricata ET MALWARE AllaKore RAT CnC Checkin M1 rev 2 2022-03-22
suricata ET MALWARE SWORD Sending Sword Marker rev 3 2022-03-22
suricata ET MALWARE AllaKore RAT ID Command Observed rev 2 2022-03-22
suricata ET MALWARE AllaKore RAT Set Keep-Alive Observed rev 2 2022-03-22
snort ET TROJAN LAME SSL Cert APT1 rev 4 2022-03-21
snort ET TROJAN NS SSL Cert APT1 rev 4 2022-03-21
snort ET INFO Possible Fake Edu Host with __test Cookie rev 2 2022-03-21
snort ET TROJAN EMAIL SSL Cert APT1 rev 4 2022-03-21
snort ET TROJAN FAKE AOL SSL Cert APT1 rev 4 2022-03-21
snort ET TROJAN FAKE YAHOO SSL Cert APT1 rev 4 2022-03-21
snort ET TROJAN Fake Virtually SSL Cert APT1 rev 4 2022-03-21
suricata ET MALWARE FAKE YAHOO SSL Cert APT1 rev 4 2022-03-21