Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET ADWARE_PUP Win32/DownloadAssistant.G Variant Error Report rev 1 2019-12-30
snort ET TROJAN Win32/BlackNET CnC Checkin rev 3 2019-12-27
snort ET TROJAN Win32/BlackNET CnC Keep-Alive rev 3 2019-12-27
snort ET TROJAN Observed Upatre CnC Domain in TLS SNI rev 2 2019-12-27
snort ET POLICY Suspicious ToTok Mobile Application DNS Request rev 2 2019-12-26
snort ET TROJAN Win32/Valak - Plugin Data Exfil rev 2 2019-12-23
snort ET TROJAN Possible XServer Backdoor Certificate Observed rev 2 2019-12-23
suricata ET MALWARE Possible XServer Backdoor Certificate Observed rev 2 2019-12-23
snort ET TROJAN Win32/Valak - Stage 2 - Response - Plugin rev 2 2019-12-22
snort ET TROJAN Win32/Valak <v9 Checkin rev 3 2019-12-22
snort ET TROJAN Win32/Valak <v20 Checkin - Server Response rev 2 2019-12-22
snort ET TROJAN Win32/Valak - Stage 2 - Response - Task rev 2 2019-12-22
suricata ET MALWARE Win32/Valak <v20 Checkin - Server Response rev 1 2019-12-22
suricata ET MALWARE Win32/Valak - Stage 2 - Response - Plugin rev 1 2019-12-22
suricata ET MALWARE Win32/Valak - Stage 2 - Response - Task rev 1 2019-12-22
snort ET MALWARE Win32/InstallDisck SMTP Checkin rev 2 2019-12-20
suricata ET SCAN Watchfire AppScan Web App Vulnerability Scanner rev 8 2019-12-20
suricata ET ADWARE_PUP Win32/InstallDisck SMTP Checkin rev 1 2019-12-20
snort ET CURRENT_EVENTS Successful Apple Phish 2019-12-18 rev 2 2019-12-18
snort ET TROJAN Win32/MailerBot CnC Activity rev 2 2019-12-18
snort ET TROJAN DiamondFox HTTP Post CnC Checkin M3 rev 3 2019-12-18
snort ET TROJAN Possible Gamaredon HEAD Request for .dot file on ddns.net rev 3 2019-12-17
snort ET TROJAN ShivaGood Ransomware CnC Checkin rev 2 2019-12-17
snort ET TROJAN Observed DNS Query for APT40 Possible DADSTACHE CnC Domain rev 2 2019-12-16
suricata ET JA3 Hash - Trojan.AndroidOS.Jocker.snt 1 rev 2 2019-12-16
snort ET WEB_CLIENT BottleEK Payload Request rev 2 2019-12-12
snort ET TROJAN AZORult v3.3 Server Response M2 rev 2 2019-12-12
snort ET TROJAN AZORult v3.2 Server Response M2 rev 2 2019-12-12
snort ET TROJAN AZORult v3.3 Server Response M1 rev 2 2019-12-12
snort ET TROJAN AZORult v3.2 Server Response M1 rev 2 2019-12-12
snort ET CURRENT_EVENTS BottleEK Plugin Check Response rev 2 2019-12-12
snort ET WEB_CLIENT BottleEK Landing rev 2 2019-12-12
snort ET TROJAN AZORult v3.3 Server Response M3 rev 2 2019-12-12
snort ET TROJAN CrownAdPro CnC Activity M1 rev 2 2019-12-12
snort ET TROJAN AZORult v3.2 Server Response M3 rev 2 2019-12-12
suricata ET MALWARE AZORult v3.3 Server Response M1 rev 2 2019-12-12
suricata ET MALWARE AZORult v3.3 Server Response M2 rev 2 2019-12-12
suricata ET MALWARE AZORult v3.2 Server Response M1 rev 1 2019-12-12
suricata ET MALWARE AZORult v3.2 Server Response M3 rev 1 2019-12-12
suricata ET MALWARE AZORult v3.2 Server Response M2 rev 1 2019-12-12