Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Operation Cobra Venom WSF Stage 2 - CnC Checkin rev 2 2019-01-08
snort ET TROJAN Operation Cobra Venom WSF Stage 1 - CnC Checkin rev 2 2019-01-08
snort ET TROJAN Operation Cobra Venom Stage 1 DNS Lookup rev 2 2019-01-08
snort ET TROJAN JS/Unk Downloader 0 Byte POST CnC Checkin rev 2 2019-01-07
snort ET POLICY External IP Address Lookup via vtransmit .com rev 2 2019-01-07
snort ET TROJAN APT28 Zebrocy/Zekapab Reporting to CnC M3 rev 2 2019-01-07
snort ET TROJAN APT28/Sofacy Zebrocy Go Variant Downloader Error POST rev 2 2019-01-03
snort ET TROJAN APT28/Sofacy Zebrocy Go Variant Checkin rev 2 2019-01-03
snort ET CURRENT_EVENTS Successful Microsoft Phish 2016-12-08 rev 2 2019-01-03
snort ET TROJAN APT28/Sofacy Zebrocy Go Variant CnC Activity rev 2 2019-01-03
snort ET TROJAN APT28/Sofacy Zebrocy Secondary Payload CnC Checkin rev 2 2019-01-03
snort ET TROJAN MSIL APT28 Zebrocy/Zekapab Reporting to CnC M2 rev 2 2019-01-03
snort ET POLICY Random Hash Pascalcoin Miner Checkin rev 2 2019-01-02
snort ET TROJAN Win32/DanaBot Harvesting Email Addresses 1 rev 3 2019-01-02
snort ET CURRENT_EVENTS Suspicious Generic Login - Possible Successful Phish 2019-01-02 rev 2 2019-01-02
snort ET TROJAN Win32/DanaBot Harvesting Email Addresses 2 rev 3 2019-01-02
snort ET CURRENT_EVENTS Apple Phishing Redirect 2019-01-02 rev 2 2019-01-02
snort ET INFO Suspicious Fake Login - Possible Phishing - 2018-12-31 rev 2 2018-12-31
snort ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 rev 4 2018-12-31
snort ET TROJAN Observed DNS Query to known Windshift APT Related Domain 2 rev 2 2018-12-27
snort ET TROJAN Observed DNS Query to known Windshift APT Related Domain 1 rev 2 2018-12-27
snort ET TROJAN MSIL.Orion Stealer Exfil via FTP rev 2 2018-12-21
snort ET TROJAN AveMaria Initial CnC Checkin rev 1 2018-12-15
snort ET TROJAN Shamoon V3 CnC Checkin rev 2 2018-12-14
snort ET INFO RealThinClient Session Init rev 7 2018-12-14
snort ET TROJAN Shamoon v3 64bit Propagating Internally via SMB rev 2 2018-12-14
snort ET TROJAN Shamoon v3 32bit Propagating Internally via SMB rev 2 2018-12-14
snort ET TROJAN ELF/Win32 Lucky Ransomware CnC Checkin rev 2 2018-12-13
snort ET TROJAN RedControle Probing Infected System rev 1 2018-12-13
snort ET TROJAN RedControle Communicating with CnC rev 1 2018-12-13
snort ET TROJAN ELF/Samba CnC Checkin rev 1 2018-12-10
snort ET WEB_SERVER HP Intelligent Management Java Deserialization RCE Attempt rev 2 2018-12-10
snort ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup rev 2 2018-12-05
snort ET WEB_SERVER Possible Cookie Based BackDoor Used in Drupal Attacks rev 2 2018-12-05
snort ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup rev 2 2018-12-05
snort ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup rev 2 2018-12-05
snort ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup rev 2 2018-12-05
snort ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup rev 2 2018-12-05
snort ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup rev 2 2018-12-05
snort ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup rev 2 2018-12-05