Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN CryptoWall/TeslaCrypt Payment Domain rev 2 2019-08-28
snort ET TROJAN Scarlet Mimic DNS Lookup 41 rev 2 2019-08-28
snort ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher DNS Lookup rev 2 2019-08-28
snort ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 6 rev 2 2019-08-28
snort ET TROJAN Observed DNS Query to Known Fenrir Ransomware CnC Domain rev 2 2019-08-28
snort ET TROJAN Ransomware Locky .onion Payment Domain rev 2 2019-08-28
snort ET TROJAN Ponmocup Post Infection DNS Lookup fasternation rev 2 2019-08-28
snort ET TROJAN ShellCrew.APT StreamEx DNS Lookup 21 rev 2 2019-08-28
snort ET TROJAN ABUSE.CH TorrenLocker Payment Domain Detected rev 2 2019-08-28
snort ET TROJAN LYCEUM CnC Domain Observed in DNS Query rev 2 2019-08-28
snort ET TROJAN Lazarus Decafett DNS Lookup 1 rev 2 2019-08-28
snort ET TROJAN Scarlet Mimic DNS Lookup 16 rev 2 2019-08-28
snort ET CURRENT_EVENTS DNS Query to Generic 107 Phishing Domain rev 2 2019-08-28
snort ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup rev 2 2019-08-28
snort ET DNS Query for a Suspicious *.upas.su domain rev 2 2019-08-28
snort ET TROJAN Ransomware Locky .onion Payment Domain rev 2 2019-08-28
snort ET TROJAN Observed DNS Query to Reborn/Ovidiy Stealer CnC Domain rev 2 2019-08-28
snort ET TROJAN Possible WannaCry DNS Lookup 2 rev 4 2019-08-28
snort ET TROJAN LokiBot Related DNS query rev 3 2019-08-28
snort ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Mar 30 M2 rev 4 2019-08-28
snort ET TROJAN Mirai Botnet Domain Observed rev 2 2019-08-28
snort ET TROJAN Sofacy DNS Lookup updatepc.org rev 3 2019-08-28
snort ET TROJAN ABUSE.CH Zloader CnC Domain Detected rev 2 2019-08-28
snort ET CURRENT_EVENTS Sparkasse Phishing Domain Nov 03 2017 rev 3 2019-08-28
snort ET TROJAN ShellCrew.APT StreamEx DNS Lookup 19 rev 2 2019-08-28
snort ET POLICY DNS Query for TOR Hidden Domain .onion Accessible Via TOR rev 2 2019-08-28
snort ET TROJAN ShellCrew.APT StreamEx DNS Lookup 5 rev 2 2019-08-28
snort ET TROJAN OSX/Proton.B DNS Lookup rev 3 2019-08-28
snort ET TROJAN Ponmocup Post Infection DNS Lookup intohave rev 2 2019-08-28
snort ET TROJAN Lazarus Decafett DNS Lookup 2 rev 2 2019-08-28
snort ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup rev 2 2019-08-28
snort ET TROJAN Ransomware CrypMIC Payment Onion Domain rev 3 2019-08-28
snort ET TROJAN Zbot .onion Proxy DNS lookup July 31 2014 rev 3 2019-08-28
snort ET TROJAN Scarlet Mimic DNS Lookup 24 rev 2 2019-08-28
snort ET TROJAN Sofacy DNS Lookup checkwinframe.com rev 3 2019-08-28
snort ET TROJAN Observed AgentTesla Domain Request rev 2 2019-08-28
snort ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 8 rev 2 2019-08-28
snort ET MOBILE_MALWARE Android/Spy.Agent.AOX Checkin rev 1 2019-08-27
snort ET POLICY Quad9 DNS Over TLS Certificate Inbound rev 2 2019-08-26
snort ET TROJAN Win32/Alpha Stealer v1.5 PWS Exfil via HTTP rev 2 2019-08-26