Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING Successful Intuit Phish 2022-02-03 rev 2 2022-02-03
suricata ET MALWARE Subterranean Crimson Rat - GetClientLog Command rev 2 2022-02-03
snort ET TROJAN HVNC BOT Detected rev 2 2022-02-02
sigma NTLM Brute Force test 2022-02-02
snort ET INFO SUSPICIOUS .LNK File Inside of Zip rev 1 2022-02-01
snort ET CURRENT_EVENTS lordspartner Phish Kit rev 1 2022-02-01
suricata ET PHISHING lordspartner Phish Kit rev 2 2022-02-01
sigma Suspicious Unblock-File test 2022-02-01
sigma Suspicious Invoke-Item From Mount-DiskImage test 2022-02-01
sigma Suspicious Mount-DiskImage test 2022-02-01
snort ET CURRENT_EVENTS LinkedIn Phish Landing Page 2022-01-31 rev 2 2022-01-31
suricata ET PHISHING LinkedIn Phish Landing Page 2022-01-31 rev 2 2022-01-31
sigma Access to Browser Login Data test 2022-01-30
sigma TeamViewer Remote Session test 2022-01-30
sigma Installation of TeamViewer Desktop test 2022-01-28
snort ET POLICY File Shared via Zoom rev 1 2022-01-26
suricata ET MALWARE Powershell with Decimal Encoded RUNPE Downloaded rev 2 2022-01-26
suricata ET HUNTING Powershell Request for paste .ee Page rev 2 2022-01-26
snort ET TROJAN Suspected APT28 Related Domain in DNS Lookup rev 2 2022-01-25
snort ET TROJAN DazzleSpy Related Domain in DNS Lookup rev 1 2022-01-25
snort ET TROJAN DazzleSpy Related Domain in DNS Lookup rev 1 2022-01-25
snort ET TROJAN W32/Witch.3FA0!tr CnC Activity M3 rev 2 2022-01-24
sigma Testing Usage of Uncommonly Used Port test 2022-01-23
sigma Suspicious SSL Connection test 2022-01-23
sigma Disable System Firewall test 2022-01-22
sigma Linux Doas Tool Execution stable 2022-01-20
snort ET TROJAN Win32/Small.NQT!tr CnC Activity rev 1 2022-01-18
suricata ET MALWARE Win32/Small.NQT!tr CnC Activity rev 1 2022-01-18
sigma Windows Network Access Suspicious desktop.ini Action test 2022-01-16
snort ET CURRENT_EVENTS Generic Phish Landing Page 2022-01-14 rev 2 2022-01-14
sigma Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon test 2022-01-14
snort ET MALWARE Win32/Hao123.C Variant CnC Activity rev 2 2022-01-13
snort ET TROJAN APT/Bitter Related CnC Activity rev 2 2022-01-13
snort ET TROJAN Observed DNS Query to Pegasus Domain rev 2 2022-01-13
snort ET CURRENT_EVENTS Successful Metawallet Phish 2022-01-13 rev 1 2022-01-13
snort ET TROJAN Observed DNS Query to Pegasus Domain rev 1 2022-01-13
suricata ET ADWARE_PUP Win32/Hao123.C Variant CnC Activity rev 1 2022-01-13
suricata ET PHISHING Metawallet Phish Landing Page 2022-01-13 rev 2 2022-01-13
suricata ET MALWARE APT/Bitter Related CnC Activity rev 1 2022-01-13
snort ET MALWARE Win32/DownWare.V Checkin rev 2 2022-01-12