Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN [GIGAMON_ATR] FIN8 BADHATCH Remote Shell Banner rev 1 2019-07-23
snort ET TROJAN FIN8 ShellTea CnC in DNS Query rev 2 2019-07-23
snort ET TROJAN FIN8 ShellTea CnC in DNS Query rev 2 2019-07-23
snort ET TROJAN FIN8 ShellTea CnC in DNS Query rev 2 2019-07-23
snort ET TROJAN FIN8 ShellTea CnC in DNS Query rev 2 2019-07-23
snort ET TROJAN FIN8 ShellTea CnC in DNS Query rev 2 2019-07-23
snort ET EXPLOIT Possible WebShell GIF Upload rev 2 2019-07-22
snort ET TROJAN Possible Outbound WebShell JPEG rev 2 2019-07-22
snort ET TROJAN Possible Outbound WebShell GIF rev 2 2019-07-22
snort ET EXPLOIT Possible WebShell JPEG Upload rev 2 2019-07-22
snort ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm Checkin UA rev 5 2019-07-19
snort ET TROJAN Win32/Blacknix CnC Checkin rev 2 2019-07-19
snort ET TROJAN Proyecto RAT Variant - Yopmail Stage 2 CnC Retrieval rev 2 2019-07-19
snort ET TROJAN Win32/Blacknix CnC Heartbeat rev 2 2019-07-19
snort ET TROJAN Gamaredon CnC Domain in DNS Lookup rev 2 2019-07-18
snort ET TROJAN Gamaredon CnC Domain in DNS Lookup rev 2 2019-07-18
snort ET TROJAN Gamaredon CnC Domain in DNS Lookup rev 2 2019-07-18
snort ET TROJAN Gamaredon CnC Domain in DNS Lookup rev 2 2019-07-18
snort ET TROJAN SLUB Domain in DNS Lookup rev 2 2019-07-17
snort ET POLICY Python-urllib/ Suspicious User Agent rev 4 2019-07-12
snort ET TROJAN eCh0raix/QNAPCrypt Requesting Key/Wallet/Note rev 1 2019-07-11
snort ET CURRENT_EVENTS Successful Generic Miarroba Phish 2019-07-11 rev 2 2019-07-11
snort ET TROJAN eCh0raix/QNAPCrypt Successful Server Response rev 1 2019-07-11
snort ET TROJAN eCh0raix/QNAPCrypt CnC Activity - Done rev 2 2019-07-11
snort ET TROJAN Vidar/Arkei/Megumin Stealer Keywords Retrieved rev 2 2019-07-11
snort ET TROJAN Win32/Unk.VBScript Requesting Instruction from CnC rev 2 2019-07-10
snort ET TROJAN Inter Skimmer CnC Domain in DNS Lookup rev 2 2019-07-08
snort ET TROJAN Inter Skimmer CnC Domain in DNS Lookup rev 2 2019-07-08
snort ET TROJAN Inter Skimmer CnC Domain in DNS Lookup rev 2 2019-07-08
snort ET TROJAN Inter Skimmer CnC Domain in DNS Lookup rev 2 2019-07-08
snort ET TROJAN Inter Skimmer CnC Domain in DNS Lookup rev 2 2019-07-08
snort ET TROJAN MuddyWater Payload Sending Screenshot to CnC rev 2 2019-07-04
snort ET TROJAN MuddyWater Payload CnC Checkin rev 2 2019-07-04
snort ET TROJAN MuddyWater Payload Sending Command Output to CnC rev 2 2019-07-04
snort ET CURRENT_EVENTS Successful France Ministry of Action and Public Accounts Phish 2019-07-04 rev 2 2019-07-04
snort ET CURRENT_EVENTS France Ministry of Action and Public Accounts Phish Landing rev 2 2019-07-04
snort ET TROJAN MuddyWater Payload Registering with CnC rev 2 2019-07-04
snort ET TROJAN Win32/Unk HeavensGate Loader CnC in DNS Lookup rev 2 2019-07-02
snort ET TROJAN APT32 CnC in DNS Lookup rev 2 2019-07-02
snort ET TROJAN APT32 Win32/Ratsnif Submitting Output of Command to CnC rev 2 2019-07-02