Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET RETIRED PoisonIvy HTTP CnC Beacon rev 5 2024-12-05
suricata ET RETIRED PoisonIvy.Esf Keepalive to CnC rev 2 2024-12-05
suricata ET HUNTING Empty Location Header from CloudFlare Server 2024-12-05 rev 1 2024-12-05
suricata ET RETIRED PoisonIvy.fishplay Keepalive to CnC rev 3 2024-12-05
suricata ET PHISHING Bitcoin Scam Webpage Observed rev 1 2024-12-05
snort ET RETIRED DNS Query Gauss Domain *.bestcomputeradvisor.com rev 6 2024-12-04
snort ET RETIRED DNS Query Known Reveton Domain whatwillber.com rev 8 2024-12-04
snort ET INFO DYNAMIC_DNS HTTP Request to a *.rkfd .com domain rev 1 2024-12-04
snort ET RETIRED DNS Query Gauss Domain *.guest-access.net rev 6 2024-12-04
snort ET INFO DYNAMIC_DNS Query to a *.rkfd .com domain rev 1 2024-12-04
snort ET INFO DYNAMIC_DNS Query to a *.tmbpc .org domain rev 1 2024-12-04
snort ET INFO DYNAMIC_DNS HTTP Request to a *.tmbpc .org domain rev 1 2024-12-04
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.rkfd .com domain rev 1 2024-12-04
suricata ET RETIRED DNS Query Gauss Domain *.bestcomputeradvisor.com rev 9 2024-12-04
suricata ET RETIRED DNS Query Gauss Domain *.guest-access.net rev 9 2024-12-04
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.tmbpc .org domain rev 1 2024-12-04
suricata ET RETIRED DNS Query Known Reveton Domain whatwillber.com rev 11 2024-12-04
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.rkfd .com domain rev 1 2024-12-04
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.tmbpc .org domain rev 1 2024-12-04
snort ET RETIRED Backdoor.Win32.ZZSlash/Redosdru.E checkin rev 3 2024-12-03
snort ET RETIRED Ruskill/Palevo KCIK IRC Command rev 6 2024-12-03
snort ET RETIRED Night Dragon CnC Beacon Outbound rev 5 2024-12-03
snort ET RETIRED Win32.Cerberus RAT Checkin Response rev 3 2024-12-03
snort ET INFO DYNAMIC_DNS HTTP Request to a *.christopherharmon .net domain rev 1 2024-12-03
snort ET RETIRED Night Dragon CnC Traffic Outbound 2 rev 7 2024-12-03
snort ET RETIRED Dropper.Win32.Agent.ahju Checkin rev 3 2024-12-03
snort ET RETIRED Dropper.Win32.Agent.bpxo Checkin rev 5 2024-12-03
snort ET RETIRED Win32.Cerberus RAT Checkin Outbound rev 5 2024-12-03
snort ET RETIRED Bifrose Client Checkin rev 3 2024-12-03
snort ET INFO DYNAMIC_DNS Query to a *.christopherharmon .net domain rev 1 2024-12-03
snort ET RETIRED Ruskill/Palevo Download Command rev 4 2024-12-03
snort ET RETIRED W32/Badlib Connectivity Check To Department of Defense Intelligence Information Systems rev 2 2024-12-03
suricata ET RETIRED Ruskill/Palevo KCIK IRC Command rev 6 2024-12-03
suricata ET RETIRED Win32.Cerberus RAT Checkin Response rev 3 2024-12-03
suricata ET RETIRED Bifrose Client Checkin rev 3 2024-12-03
suricata ET RETIRED W32/Badlib Connectivity Check To Department of Defense Intelligence Information Systems rev 2 2024-12-03
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.christopherharmon .net domain rev 1 2024-12-03
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.christopherharmon .net domain rev 1 2024-12-03
suricata ET RETIRED Dropper.Win32.Agent.bpxo Checkin rev 5 2024-12-03
suricata ET RETIRED Backdoor.Win32.ZZSlash/Redosdru.E checkin rev 3 2024-12-03