Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN CozyDuke APT Possible SSL Cert 5 rev 1 2015-04-22
snort ET TROJAN CozyDuke APT Possible SSL Cert 4 rev 1 2015-04-22
snort ET TROJAN CozyDuke APT Possible SSL Cert 7 rev 1 2015-04-22
snort ET TROJAN CozyDuke APT Possible SSL Cert 3 rev 1 2015-04-22
snort ET TROJAN Windows nbtstat -a Microsoft Windows DOS prompt command exit OUTBOUND rev 2 2015-04-21
snort ET TROJAN Windows nbtstat -s Microsoft Windows DOS prompt command exit OUTBOUND rev 2 2015-04-21
snort ET TROJAN Windows nbtstat -r Microsoft Windows DOS prompt command exit OUTBOUND rev 2 2015-04-21
snort ET TROJAN Dalexis CnC Beacon rev 3 2015-04-17
snort ET TROJAN PunkeyPOS HTTP CnC Beacon 4 rev 1 2015-04-17
snort ET TROJAN PunkeyPOS HTTP CnC Beacon Fake UA rev 1 2015-04-17
snort ET TROJAN PunkeyPOS HTTP CnC Beacon 1 rev 1 2015-04-17
snort ET TROJAN FighterPOS CnC Beacon 2 rev 1 2015-04-16
snort ET TROJAN Zacom/NFlog HTTP POST Connectivity Check rev 1 2015-04-16
snort ET TROJAN FighterPOS CnC Beacon 1 rev 1 2015-04-16
snort ET TROJAN Upatre Binary Download Jan 02 2014 rev 2 2015-04-15
snort ET POLICY Nessus Vulnerability Scanner Plugins Update rev 6 2015-04-15
snort ET ATTACK_RESPONSE Matahari client rev 12 2015-04-15
snort ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack rev 6 2015-04-15
snort ET TROJAN W32/Farfli.BHQ!tr Dropper CnC Beacon 2 rev 1 2015-04-15
snort ET SCAN ICMP =XXXXXXXX Likely Precursor to Scan rev 4 2015-04-15
snort ET POLICY Exe32Pack Packed Executable Download rev 1 2015-04-15
snort ET TROJAN Win32/Ruckguv.A Requesting Payload rev 1 2015-04-14
snort ET TROJAN LankerBoy HTTP CnC Beacon rev 1 2015-04-14
snort ET TROJAN CoinVault CnC Beacon M2 rev 1 2015-04-14
snort ET TROJAN CoinVault CnC Beacon M1 rev 1 2015-04-14
snort ET TROJAN Possible APT30 or Win32/Nuclear HTTP Framework POST rev 3 2015-04-13
snort ET CURRENT_EVENTS DRIVEBY EXE Embeded in Page Likely Evil M1 rev 1 2015-04-11
snort ET CURRENT_EVENTS DRIVEBY EXE Embeded in Page Likely Evil M2 rev 1 2015-04-11
snort ET EXPLOIT ASUS RT N56U Router DNS Change GET Request 3 rev 1 2015-04-09
snort ET TROJAN Kriptovor SMTP Traffic rev 1 2015-04-09
snort ET EXPLOIT Belkin G F5D7230-4 Router DNS Change GET Request rev 1 2015-04-09
snort ET EXPLOIT FritzBox RCE GET Request rev 2 2015-04-09
snort ET EXPLOIT TP-LINK TL-WR750N DNS Change GET Request rev 1 2015-04-09
snort ET EXPLOIT Tenda ADSL2/2+ Router DNS Change GET Request rev 1 2015-04-09
snort ET EXPLOIT Linksys WRT54GL DNS Change GET Request rev 1 2015-04-09
snort ET EXPLOIT D-link DI604 Known Malicious Router DNS Change GET Request rev 1 2015-04-09
snort ET EXPLOIT Belkin Wireless G Router DNS Change POST Request rev 3 2015-04-09
snort ET EXPLOIT TP-LINK Known Malicious Router DNS Change GET Request rev 1 2015-04-09
snort ET EXPLOIT Netgear WNDR Router DNS Change POST Request rev 2 2015-04-09
snort ET EXPLOIT Known Malicious Router DNS Change GET Request rev 1 2015-04-09