Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Glupteba CnC Domain in DNS Lookup rev 2 2019-09-05
snort ET TROJAN Glupteba CnC Domain in DNS Lookup rev 2 2019-09-05
snort ET TROJAN Glupteba CnC Domain in DNS Lookup rev 2 2019-09-05
snort ET TROJAN Glupteba CnC Domain in DNS Lookup rev 2 2019-09-05
snort ET TROJAN W32/Pterodo CnC Checkin rev 2 2019-09-04
snort ET TROJAN Win32/Laturo Stealer CnC Checkin rev 2 2019-09-04
snort ET POLICY DNS Query to a Reverse Proxy Service Observed rev 2 2019-09-03
snort ET POLICY DNS Query to a Reverse Proxy Service Observed rev 2 2019-09-03
snort ET POLICY DNS Query to a Reverse Proxy Service Observed rev 2 2019-09-03
snort ET CURRENT_EVENTS Successful Mailbox Update Phish 2016-02-17 rev 2 2019-09-03
snort ET MOBILE_MALWARE Android/Locker.B Checkin 1 rev 2 2019-09-03
snort ET CURRENT_EVENTS Successful National Australia Bank Phish 2016-12-02 rev 2 2019-09-03
snort ET TROJAN Nitlove POS CnC rev 2 2019-09-03
snort ET CURRENT_EVENTS Successful FR Carte Bleue / BCP Phish 2016-09-06 rev 2 2019-09-03
snort ET MOBILE_MALWARE Android/Locker.B Checkin 2 rev 2 2019-09-03
suricata ET DNS DNS Lookup for localhost.DOMAIN.TLD rev 6 2019-09-03
snort ET TROJAN Possible APT28 Maldoc CnC Checkin rev 2 2019-09-02
snort ET MOBILE_MALWARE Apple iPhone Implant - Boundary Observed rev 2 2019-08-30
snort ET MOBILE_MALWARE Apple iPhone Implant - Upload Files rev 2 2019-08-30
snort ET TROJAN Domen SocEng CnC Observed in DNS Query rev 2 2019-08-30
snort ET WEB_SERVER WebShell Generic - *.tar.gz in POST body rev 2 2019-08-30
snort ET TROJAN Domen SocEng CnC Observed in DNS Query rev 2 2019-08-30
snort ET CURRENT_EVENTS Domen SocEng Redirect - Landing Page Observed rev 2 2019-08-30
snort ET CURRENT_EVENTS RIG EK - Unexpected Victim Location Server Response rev 2 2019-08-30
snort ET MOBILE_MALWARE Apple iPhone Implant - Command Executed rev 2 2019-08-30
snort ET TROJAN Domen SocEng CnC Observed in DNS Query rev 2 2019-08-30
snort ET CURRENT_EVENTS Successful Facebook Phish 2019-08-29 rev 2 2019-08-29
snort ET TROJAN ShellCrew.APT StreamEx DNS Lookup 2 rev 2 2019-08-28
snort ET TROJAN Sofacy DNS Lookup securitypractic.com rev 3 2019-08-28
snort ET TROJAN Mirai Botnet Domain Observed rev 2 2019-08-28
snort ET POLICY Middle Earth Illegal Marketplace Tor Hidden Service DNS Query rev 2 2019-08-28
snort ET CURRENT_EVENTS Raiffeisen Phishing Domain Nov 03 2017 rev 3 2019-08-28
snort ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 15 rev 2 2019-08-28
snort ET TROJAN Scarlet Mimic DNS Lookup 27 rev 2 2019-08-28
snort ET TROJAN Sofacy DNS Lookup secnetcontrol.com rev 3 2019-08-28
snort ET TROJAN LYCEUM CnC Domain Observed in DNS Query rev 2 2019-08-28
snort ET POLICY Query to a *.opengw.net Open VPN Relay Domain rev 6 2019-08-28
snort ET TROJAN LokiBot Related DNS query rev 3 2019-08-28
snort ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 7 rev 2 2019-08-28
snort ET TROJAN Sofacy DNS Lookup rev 2 2019-08-28