Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN CommentCrew Possible APT c2 communications sleep rev 2 2014-09-19
snort ET SCAN Simple Slowloris Flooder rev 3 2014-09-19
snort ET TROJAN Georgian Targeted Attack - Trojan Checkin rev 2 2014-09-19
snort ET TROJAN W32/Tobfy.Ransomware CnC Request - status.php rev 3 2014-09-19
snort ET TROJAN CommentCrew Possible APT crabdance backdoor base64 head 2 rev 3 2014-09-19
snort ET TROJAN W32/Zeus.InfoStealer Infection Campaign Wav.exe Request rev 2 2014-09-19
snort ET TROJAN CommentCrew Possible APT c2 communications download client.png rev 3 2014-09-19
snort ET TROJAN Zeus.Downloader Campaign Unknown Initial CnC Beacon rev 3 2014-09-19
snort ET TROJAN Trojan Downloader GetBooks UA rev 7 2014-09-19
snort ET TROJAN CommentCrew Possible APT c2 communications html return 1 rev 3 2014-09-19
snort ET TROJAN CommentCrew Possible APT c2 communications sleep2 rev 2 2014-09-19
snort ET TROJAN CommentCrew Possible APT c2 communications sleep3 rev 3 2014-09-19
snort ET TROJAN Zbot UA rev 3 2014-09-19
snort ET TROJAN CommentCrew Possible APT c2 communications get command client key rev 5 2014-09-19
snort ET TROJAN CommentCrew UGX Backdoor initial connection rev 3 2014-09-19
snort ET TROJAN W32/Tobfy.Ransomware Invalid URI CnC Request rev 3 2014-09-19
snort ET TROJAN CommentCrew Possible APT backdoor download logo.png rev 4 2014-09-19
snort ET TROJAN CommentCrew downloader without user-agent string exe download without User Agent rev 2 2014-09-19
snort ET WEB_SERVER Joomla Component SQLi Attempt rev 2 2014-09-19
snort ET TROJAN CommentCrew Possible APT c2 communications get system rev 4 2014-09-19
snort ET TROJAN CommentCrew Possible APT c2 communications sleep5 rev 3 2014-09-19
snort ET TROJAN CommentCrew Possible APT backdoor stage 2 download base64 update.gif rev 3 2014-09-19
snort ET TROJAN CommentCrew Possible APT crabdance backdoor base64 head rev 3 2014-09-19
snort ET TROJAN OneLouder EXE download possibly installing Zeus P2P rev 3 2014-09-19
snort ET TROJAN Kuluoz/Asprox CnC Response rev 2 2014-09-18
snort ET P2P BitTorrent Traffic rev 9 2014-09-18
snort ET WEB_SERVER HTTP POST Generic eval of base64_decode rev 1 2014-09-16
snort ET INFO HTTP Request to a *.edu.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.c0m.li domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.us.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.co.com.au domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.upas.su domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.de.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.ca.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.nl.ai domain rev 2 2014-09-15
snort ET WEB_CLIENT Likely MS12-004 midiOutPlayNextPolyEvent Heap Overflow Midi Filename Requested baby.mid rev 2 2014-09-15
snort ET INFO HTTP Request to a *.uni.cc domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.ru.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.ch.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.dtdns.net domain rev 2 2014-09-15