Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
elastic SMTP to the Internet deprecated 2021-04-15
elastic Hex Encoding/Decoding Activity deprecated 2021-04-15
elastic Trusted Developer Application Usage deprecated 2021-04-15
elastic TCP Port 8000 Activity to the Internet deprecated 2021-04-15
elastic Query Registry via reg.exe deprecated 2021-04-15
elastic Potential Persistence via Cron Job deprecated 2021-04-15
elastic Network Sniffing via Tcpdump deprecated 2021-04-15
elastic Proxy Port Activity to the Internet deprecated 2021-04-15
elastic Process Discovery via Tasklist deprecated 2021-04-15
elastic RDP (Remote Desktop Protocol) to the Internet deprecated 2021-04-15
elastic FTP (File Transfer Protocol) Activity to the Internet deprecated 2021-04-15
elastic Mknod Process Activity deprecated 2021-04-15
elastic SSH (Secure Shell) from the Internet deprecated 2021-04-15
elastic PowerShell spawning Cmd deprecated 2021-04-15
snort ET TROJAN RedLine - GetArguments Request rev 2 2021-04-14
snort ET INFO Suspicious Netlify Hosted DNS Request - Possible Phishing Landing rev 2 2021-04-14
suricata ET HUNTING Suspicious Netlify Hosted DNS Request - Possible Phishing Landing rev 1 2021-04-14
suricata ET HUNTING Suspicious Netlify Hosted TLS SNI Request - Possible Phishing Landing rev 1 2021-04-14
snort ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2021-04-12
snort ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2021-04-12
snort ET INFO HTTP Request for OpenNIC API GeoIP Request rev 2 2021-04-12
snort ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2021-04-12
snort ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2021-04-12
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2021-04-12
suricata ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2021-04-12
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2021-04-12
suricata ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2021-04-12
snort ET CURRENT_EVENTS Successful Paypal Phish M3 2016-10-26 rev 4 2021-04-09
snort ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2021-04-09
snort ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2021-04-09
suricata ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2021-04-09
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2021-04-09
snort ET INFO Observed POST to xsph .ru Domain rev 2 2021-04-08
snort ET MALWARE Downer.B Variant Checkin rev 3 2021-04-08
snort ET TROJAN Ozone/Darktrack RAT Variant - Server Hello rev 1 2021-04-08
suricata ET ADWARE_PUP Downer.B Variant Checkin rev 2 2021-04-08
suricata ET MALWARE Ozone/Darktrack RAT Variant - Server Hello rev 1 2021-04-08
snort ET CURRENT_EVENTS Generic Bank Captcha Phishing Landing rev 2 2021-04-06
snort ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2021-04-06
snort ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2021-04-06