Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE TA421/YTTRIUM/APT29 TLS Certificate M2 rev 3 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.rkumar .com .np domain rev 1 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.hippocentre .ru domain rev 1 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.euro-line .hu domain rev 1 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.vlaves .bg domain rev 1 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.intinet .com .ar domain rev 1 2025-09-17
suricata ET MALWARE TA421/YTTRIUM/APT29 TLS Certificate M1 rev 3 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.litos .co .uk domain rev 1 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.euro-line .hu domain rev 1 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.hippocentre .ru domain rev 1 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.litos .co .uk domain rev 1 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.insuter .com .ar domain rev 1 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.gauravn .com .np domain rev 1 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.intinet .com .ar domain rev 1 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.rkumar .com .np domain rev 1 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.gauravn .com .np domain rev 1 2025-09-17
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.vlaves .bg domain rev 1 2025-09-17
suricata ET MALWARE FrigidBackdoor Poll for Commands rev 1 2025-09-17
snort ET INFO DYNAMIC_DNS HTTP Request to a *.die-pichlers .at domain rev 1 2025-09-16
snort ET INFO DYNAMIC_DNS HTTP Request to a *.adutchmaninwalldorf .de domain rev 1 2025-09-16
snort ET INFO DYNAMIC_DNS HTTP Request to a *.bukomp .ru domain rev 1 2025-09-16
snort ET INFO DYNAMIC_DNS Query to a *.johngross .biz domain rev 1 2025-09-16
snort ET INFO DYNAMIC_DNS Query to a *.bukomp .ru domain rev 1 2025-09-16
snort ET INFO DYNAMIC_DNS HTTP Request to a *.johngross .biz domain rev 1 2025-09-16
snort ET TROJAN Shai-Hulud NPM Malware Creating Github Repository rev 1 2025-09-16
snort ET INFO DYNAMIC_DNS Query to a *.die-pichlers .at domain rev 1 2025-09-16
snort ET INFO DYNAMIC_DNS Query to a *.comit .com .ar domain rev 1 2025-09-16
snort ET TROJAN VampireBot CnC Config Inbound rev 1 2025-09-16
snort ET INFO DYNAMIC_DNS Query to a *.adutchmaninwalldorf .de domain rev 1 2025-09-16
snort ET INFO DYNAMIC_DNS HTTP Request to a *.comit .com .ar domain rev 1 2025-09-16
suricata ET MALWARE Shai-Hulud NPM Malware Creating Github Repository rev 1 2025-09-16
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.johngross .biz domain rev 1 2025-09-16
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.adutchmaninwalldorf .de domain rev 1 2025-09-16
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.die-pichlers .at domain rev 1 2025-09-16
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.comit .com .ar domain rev 1 2025-09-16
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.die-pichlers .at domain rev 1 2025-09-16
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.comit .com .ar domain rev 1 2025-09-16
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.bukomp .ru domain rev 1 2025-09-16
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bukomp .ru domain rev 1 2025-09-16
suricata ET MALWARE VampireBot CnC Config Inbound rev 1 2025-09-16