Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Xenorat Default C2 Server Response Inbound rev 1 2024-12-19
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.freedns .rocks domain rev 1 2024-12-19
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.freedns .rocks domain rev 1 2024-12-19
suricata ET MALWARE Xenorat Default Handshake Inbound rev 1 2024-12-19
sigma File Creation Related To RAT Clients experimental 2024-12-19
sigma QuickAssist Execution experimental 2024-12-19
sigma Lummac Stealer Activity - Execution Of More.com And Vbc.exe experimental 2024-12-19
sigma DNS Query Request By QuickAssist.EXE experimental 2024-12-19
sigma AWS SAML Provider Deletion Activity experimental 2024-12-19
sigma AWS Key Pair Import Activity experimental 2024-12-19
sigma New AWS Lambda Function URL Configuration Created experimental 2024-12-19
snort ET TROJAN Generic Powershell Loader Using Encryption Routine Inbound rev 1 2024-12-17
snort ET INFO DYNAMIC_DNS HTTP Request to a *.familyjam .es domain rev 1 2024-12-17
snort ET INFO DYNAMIC_DNS Query to a *.cloudn9ne .org domain rev 1 2024-12-17
snort ET INFO DYNAMIC_DNS HTTP Request to a *.cloudn9ne .org domain rev 1 2024-12-17
snort ET INFO DYNAMIC_DNS Query to a *.familyjam .es domain rev 1 2024-12-17
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.cloudn9ne .org domain rev 1 2024-12-17
suricata ET MALWARE Generic Powershell Loader Using Encryption Routine Inbound rev 1 2024-12-17
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.familyjam .es domain rev 1 2024-12-17
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.familyjam .es domain rev 1 2024-12-17
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.cloudn9ne .org domain rev 1 2024-12-17
sigma DNS Query To Remote Access Software Domain From Non-Browser App test 2024-12-17
snort ET INFO DYNAMIC_DNS HTTP Request to a *.ospa .fi domain rev 1 2024-12-16
snort ET INFO DYNAMIC_DNS Query to a *.ospa .fi domain rev 1 2024-12-16
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ospa .fi domain rev 1 2024-12-16
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.ospa .fi domain rev 1 2024-12-16
suricata ET MALWARE [CIS] GootLoader C2 Activity - Windows Server 2012 R2/Windows 8.1 - barefootinc.com[.]au rev 1 2024-12-15
suricata ET MALWARE [CIS] Gootloader C2 Activity - Windows Server 2016 - barefootinc.com[.]au rev 1 2024-12-15
suricata ET MALWARE [CIS] GootLoader C2 Activity - Windows 10/Server 2019/2022 - barefootinc.com[.]au rev 1 2024-12-15
suricata ET MALWARE [CIS] GootLoader C2 Activity - Windows 11 - barefootinc.com[.]au rev 1 2024-12-15
snort ET INFO DYNAMIC_DNS HTTP Request to a *.indiaguru .com domain rev 1 2024-12-14
snort ET INFO DYNAMIC_DNS Query to a *.indiaguru .com domain rev 1 2024-12-14
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.indiaguru .com domain rev 1 2024-12-14
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.indiaguru .com domain rev 1 2024-12-14
sigma Potential Secure Deletion with SDelete test 2024-12-13
snort ET ATTACK_RESPONSE Nishang Invoke-PowerShellTcp Shell Prompt Outbound rev 2 2024-12-12
snort ET INFO DYNAMIC_DNS Query to a *.thisoldrack .org domain rev 1 2024-12-12
snort ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page Inbound rev 2 2024-12-12
snort ET ATTACK_RESPONSE Base64 Encoded Powershell Performing Byte Operations Inbound rev 2 2024-12-12
snort ET ATTACK_RESPONSE PowerShell Geo Check Before Execution rev 4 2024-12-12