Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup rev 2 2018-12-05
snort ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup rev 2 2018-12-05
snort ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup rev 2 2018-12-05
snort ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup rev 2 2018-12-05
snort ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup rev 2 2018-12-05
snort ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup rev 2 2018-12-05
snort ET TROJAN STOLENPENCIL CnC Domain in DNS Lookup rev 2 2018-12-05
snort ET TROJAN Observed DNS Query for MageCart Data Exfil Domain rev 2 2018-12-04
snort ET TROJAN Observed DNS Query for MageCart Data Exfil Domain rev 2 2018-12-04
snort ET INFO Certificate with Unknown Content M2 rev 2 2018-12-04
snort ET INFO Certificate with Unknown Content M1 rev 3 2018-12-04
snort ET TROJAN MSIL APT28 Zebrocy/Zekapab Reporting to CnC rev 2 2018-11-30
snort ET TROJAN IcedID WebSocket Request rev 1 2018-11-29
snort ET TROJAN DNS Query for DNSpionage CnC Domain rev 4 2018-11-29
snort ET CURRENT_EVENTS Inbound PowerShell Executing Base64 Decoded VBE from Temp 2018-11-29 rev 2 2018-11-29
snort ET TROJAN DNSpionage Requesting Config rev 2 2018-11-29
snort ET TROJAN L0rdix Stealer CnC Sending Screenshot rev 2 2018-11-28
snort ET TROJAN L0rdix Stealer CnC Data Exfil rev 2 2018-11-28
snort ET CURRENT_EVENTS Generic Xbalti Phishing Landing 2018-11-26 rev 2 2018-11-26
snort ET TROJAN HackTool.Linux.SSHBRUTE.A Haiduc Initial Compromise C2 POST rev 1 2018-11-21
snort ET TROJAN JS.InfectedMikrotik Injects Domain Observed in TLS SNI rev 2 2018-11-19
snort ET TROJAN JS.InfectedMikrotik Injects Domain Observed in DNS Lookup rev 2 2018-11-19
snort ET TROJAN DarkGate CnC Requesting Data Exfiltration from Bot rev 2 2018-11-19
snort ET TROJAN JS.InfectedMikrotik Injects Domain Observed in DNS Lookup rev 2 2018-11-19
snort ET TROJAN JS.InfectedMikrotik Injects Domain Observed in DNS Lookup rev 2 2018-11-19
snort ET TROJAN JS.InfectedMikrotik Injects Domain Observed in DNS Lookup rev 1 2018-11-19
snort ET TROJAN JS.InfectedMikrotik Injects Domain Observed in DNS Lookup rev 2 2018-11-19
snort ET TROJAN JS.InfectedMikrotik Injects Domain Observed in DNS Lookup rev 2 2018-11-19
snort ET TROJAN JS.InfectedMikrotik Injects Domain Observed in DNS Lookup rev 2 2018-11-19
snort ET TROJAN DarkGate CNC Checkin rev 2 2018-11-19
snort ET TROJAN TEMP.Periscope APT Domain in DNS Lookup rev 3 2018-11-16
snort ET TROJAN Hades APT Downloader Attempting to Retrieve Stage 2 Payload rev 2 2018-11-16
snort ET TROJAN ELF/Muhstik Scanner Module Activity rev 2 2018-11-15
snort ET TROJAN Operation Mystery Baby syschk CnC Communication rev 2 2018-11-15
snort ET TROJAN Operation Baby Coin syschk CnC Communication rev 2 2018-11-15
snort ET TROJAN JunkMiner Downloader Communicating with CnC rev 2 2018-11-14
snort ET TROJAN MSIL.Kraken.v2 HTTP Pattern rev 1 2018-11-09
snort ET TROJAN ArrobarLoader CnC Checkin M1 rev 3 2018-11-08
snort ET TROJAN JavaRAT Sending Screenshot rev 1 2018-11-07
snort ET TROJAN Sharik/Smoke CnC Beacon 12 rev 3 2018-11-07