Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CURRENT_EVENTS Possible Docusign Phishing Landing - Title over non SSL rev 3 2020-12-10
snort ET CURRENT_EVENTS Successful Google Account Phish Dec 04 2012 rev 4 2020-12-10
suricata ET MALWARE PHPs Labyrinth Backdoor Stage1 CnC Activity rev 3 2020-12-10
suricata ET PHISHING Successful Google Account Phish Dec 04 2012 rev 6 2020-12-10
suricata ET WEB_CLIENT Fake Java Installer Landing Page Oct 21 rev 4 2020-12-10
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server 3] rev 3 2020-12-09
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.GORAT.[SID1] rev 3 2020-12-09
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server 2] rev 3 2020-12-09
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.GORAT.[POST] rev 3 2020-12-09
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle USAToday Server] rev 3 2020-12-09
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES Server] rev 3 2020-12-09
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Stager 2] rev 3 2020-12-09
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice POST] rev 3 2020-12-09
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle USAToday Server] rev 3 2020-12-09
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice Server] rev 3 2020-12-09
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server] rev 3 2020-12-09
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice POST] rev 3 2020-12-09
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.DNS.BEACON.[CSBundle DNS] rev 3 2020-12-09
snort ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M1 rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] Backdoor.SSL.BEACON.[CSBundle Ajax] rev 2 2020-12-08
snort ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2020-12-08
snort ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.GORAT.[Build ID] rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] HackTool.TCP.Rubeus.[nonce] rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M2 rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M4 rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M7 rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] HackTool.UDP.Rubeus.[nonce 2] rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M6 rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M3 rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] Backdoor.DNS.BEACON.[CSBundle DNS] rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] POSSIBLE HackTool.TCP.Rubeus.[User32LogonProcesss] rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M9 rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M5 rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] HackTool.TCP.Rubeus.[nonce 2] rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] HackTool.UDP.Rubeus.[nonce] rev 2 2020-12-08
snort ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M8 rev 2 2020-12-08
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2020-12-08
suricata ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M9 rev 2 2020-12-08
suricata ET CURRENT_EVENTS [Fireeye] HackTool.TCP.Rubeus.[nonce 2] rev 1 2020-12-08