Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Oyster Backdoor CnC Checkin M3 rev 1 2025-09-12
snort ET INFO DYNAMIC_DNS Query to a *.bernhard-rau .de domain rev 1 2025-09-12
snort ET INFO DYNAMIC_DNS HTTP Request to a *.art-motel .com domain rev 1 2025-09-12
snort ET INFO DYNAMIC_DNS HTTP Request to a *.qs0 .de domain rev 1 2025-09-12
snort ET INFO DYNAMIC_DNS HTTP Request to a *.o-rg .net domain rev 1 2025-09-12
snort ET INFO DYNAMIC_DNS HTTP Request to a *.lyxcorp .com domain rev 1 2025-09-12
snort ET INFO DYNAMIC_DNS Query to a *.enenet .co .uk domain rev 1 2025-09-12
snort ET INFO DYNAMIC_DNS Query to a *.qs0 .de domain rev 1 2025-09-12
snort ET INFO DYNAMIC_DNS Query to a *.lyxcorp .com domain rev 1 2025-09-12
snort ET INFO DYNAMIC_DNS HTTP Request to a *.bernhard-rau .com domain rev 1 2025-09-12
snort ET INFO DYNAMIC_DNS Query to a *.o-rg .net domain rev 1 2025-09-12
snort ET INFO DYNAMIC_DNS HTTP Request to a *.bernhard-rau .de domain rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.bernhard-rau .com domain rev 1 2025-09-12
suricata ET MALWARE Oyster Backdoor CnC Checkin M2 rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.lyxcorp .com domain rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.art-motel .com domain rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.enenet .co .uk domain rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.u-resort .com domain rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.o-rg .net domain rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.bernhard-rau .de domain rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bernhard-rau .com domain rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.qs0 .de domain rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.enenet .co .uk domain rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.u-resort .com domain rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.lyxcorp .com domain rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.art-motel .com domain rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bernhard-rau .de domain rev 1 2025-09-12
suricata ET MALWARE Oyster Backdoor CnC Checkin M3 rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.o-rg .net domain rev 1 2025-09-12
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.qs0 .de domain rev 1 2025-09-12
sigma Query Tor Onion Address - DNS Client test 2025-09-12
sigma DNS TOR Proxies test 2025-09-12
sigma DNS Query Tor .Onion Address - Sysmon test 2025-09-12
snort ET INFO DYNAMIC_DNS Query to a *.knr .cl domain rev 1 2025-09-11
snort ET INFO DYNAMIC_DNS Query to a *.mindboggle .us domain rev 1 2025-09-11
snort ET INFO DYNAMIC_DNS Query to a *.digitalforest .my domain rev 1 2025-09-11
snort ET INFO DYNAMIC_DNS Query to a *.shitstudent .com domain rev 1 2025-09-11
snort ET INFO DYNAMIC_DNS HTTP Request to a *.knr .cl domain rev 1 2025-09-11
snort ET INFO DYNAMIC_DNS Query to a *.viar3d .com domain rev 1 2025-09-11
snort ET INFO DYNAMIC_DNS Query to a *.mjfuentes .com domain rev 1 2025-09-11