Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET RETIRED Win32/Delf.TJJ CnC Checkin M2 rev 3 2025-04-17
suricata ET RETIRED Win32/Fewin Stealer Data Exfiltration Attempt rev 4 2025-04-17
suricata ET RETIRED [ANY.RUN] ZharkBOT HTTP CnC Checkin rev 3 2025-04-17
suricata ET RETIRED Malformed HeartBeat Request rev 5 2025-04-17
suricata ET RETIRED ZuoRAT CBeacon CnC rev 4 2025-04-17
suricata ET MALWARE CHStealer getshortinfo Command CnC Checkin rev 1 2025-04-17
suricata ET RETIRED Suspected Andariel RexPot CnC Checkin M2 rev 3 2025-04-17
suricata ET RETIRED Earth Lusca/SprySOCKS CnC Checkin rev 3 2025-04-17
suricata ET RETIRED Win32/Delf.TJJ CnC Checkin M1 rev 3 2025-04-17
suricata ET MALWARE CHStealer checkping Command CnC Checkin rev 1 2025-04-17
suricata ET RETIRED IIS-Raid Module Backdoor Ping in HTTP Request rev 3 2025-04-17
suricata ET RETIRED Earth Lusca/SprySOCKS CnC Domain in DNS Lookup rev 2 2025-04-17
suricata ET RETIRED Win32/Covagent Checkin rev 3 2025-04-17
suricata ET RETIRED BunnyLoader CnC Checkin - Heartbeat rev 5 2025-04-17
suricata ET RETIRED BunnyLoader Data Exfiltration Attempt rev 4 2025-04-17
suricata ET RETIRED Malformed HeartBeat Response rev 7 2025-04-17
suricata ET RETIRED MacOS/RustBucket System Information Exfiltration Attempt rev 3 2025-04-17
suricata ET RETIRED BunnyLoader CnC Checkin - Retrieve Tasking rev 5 2025-04-17
suricata ET RETIRED TA453 Modified IIS-Raid Backdoor Module Headers in HTTP Request rev 3 2025-04-17
suricata ET RETIRED Possible KV Botnet CnC Checkin rev 3 2025-04-17
suricata ET RETIRED [ANY.RUN] Remcos RAT Checkin 861 rev 2 2025-04-17
suricata ET RETIRED BunnyLoader CnC Tasking Response rev 3 2025-04-17
suricata ET RETIRED TA453 BellaCiao ASPX Backdoor User-Agent in HTTP Request rev 4 2025-04-17
suricata ET RETIRED Win32/Agent.XXZ Checkin rev 3 2025-04-17
suricata ET RETIRED Malformed HeartBeat Request method 2 rev 5 2025-04-17
suricata ET RETIRED Suspected Andariel RexPot CnC Checkin M1 rev 3 2025-04-17
suricata ET RETIRED Win32/Aurora Stealer Accept Command rev 3 2025-04-17
suricata ET RETIRED Red Wolf/RedCurl Payload Retrieval Attempt M5 rev 4 2025-04-17
suricata ET RETIRED IIS-Raid Module Backdoor Default Headers in HTTP Request rev 3 2025-04-17
suricata ET RETIRED Android/MMRAT Data Exfiltration Attempt rev 3 2025-04-17
suricata ET RETIRED Kimsuky ReconShark Related APT Activity rev 5 2025-04-17
suricata ET RETIRED Win32/Aurora Stealer Thanks Command rev 3 2025-04-17
suricata ET RETIRED Suspicious Request for bd.log rev 3 2025-04-17
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.budjettravel .net domain rev 1 2025-04-17
suricata ET RETIRED Truebot/Silence.Downloader No Tasking Response from Server rev 3 2025-04-17
suricata ET RETIRED GO/Titan Stealer Data Exfiltration Attempt rev 4 2025-04-17
sigma Suspicious Process Spawned by CentreStack Portal AppPool experimental 2025-04-17
suricata ET MALWARE zgRAT / PureLogs CnC Backdoor Server GZIP Traffic rev 1 2025-04-16
suricata ET MALWARE zgRAT / PureLogs CnC Backdoor Client GZIP Traffic rev 1 2025-04-16
snort ET CURRENT_EVENTS Observed DNS Query to TA450 Domain rev 2 2025-04-16