Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.abatek .com Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.hicam .net Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.toythieves .com Domain rev 2 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.jwork .ru Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.clickit .com Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.x24hr .com Domain rev 2 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.is-a-guru .com Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.potomacriversafetycommittee .org Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.dontexist .com Domain rev 3 2024-06-11
suricata ET DYN_DNS DNS Query to DynDNS Domain *.servesarcasm .com rev 2 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS Query to freemyip .com Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.andreymorozov .ru Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.18t .biz Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.rwbcode .com Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.photogenic .hk Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.2fine .de Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.cobos .mx Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.instanthq .com Domain rev 2 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.dark-byte .net Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.lovethosetrains .com Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bellywings .com Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.from-ok .com Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ljhb .se Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.us .to Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.homenode .ca Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.audolatry .com Domain rev 3 2024-06-11
snort ET EXPLOIT PHP-Live-Chat Get Shell Attempt Inbound rev 1 2024-06-10
snort ET WEB_SERVER Generic PHP Remote File Include rev 2 2024-06-10
snort ET EXPLOIT Hongjing eHR Showmedia.jsp SQL Injection Inbound rev 1 2024-06-10
suricata ET REMOTE_ACCESS AnyDesk Revoked Code Signing Certificate Observed rev 2 2024-06-10
suricata ET REMOTE_ACCESS Inbound RDP Connection with TLS Security Protocol Requested rev 4 2024-06-10
suricata ET MALWARE ClearFake User-Agent Observed rev 1 2024-06-10
suricata ET REMOTE_ACCESS Inbound RDP Connection with Minimal Security Protocol Requested rev 4 2024-06-10
suricata ET REMOTE_ACCESS ScreenConnect/ConnectWise Initial Checkin Packet M1 rev 3 2024-06-10
suricata ET REMOTE_ACCESS Tunneled RDP Handshake rev 2 2024-06-10
suricata ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent rev 6 2024-06-10
suricata ET REMOTE_ACCESS ScreenConnect/ConnectWise Initial Checkin Packet M2 rev 4 2024-06-10
suricata ET EXPLOIT Hongjing eHR Showmedia.jsp SQL Injection Inbound rev 1 2024-06-10
suricata ET PHISHING Telegram QR Code Login Landing Page 2024-06-10 rev 1 2024-06-10
suricata ET EXPLOIT PHP-Live-Chat Get Shell Attempt Inbound rev 1 2024-06-10