Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Observed TA453 Related Domain in TLS SNI rev 1 2024-05-06
snort ET TROJAN DNS Query to TA453 Domain rev 1 2024-05-06
snort ET TROJAN Observed TA453 Domain in TLS SNI rev 1 2024-05-06
snort ET TROJAN TA453 Related Domain in DNS Lookup rev 1 2024-05-06
snort ET TROJAN Observed TA453 Domain in TLS SNI rev 1 2024-05-06
snort ET TROJAN DNS Query to TA453 Domain rev 1 2024-05-06
snort ET TROJAN BunnyLoader 3.0 Initial Checkin rev 2 2024-05-06
suricata ET MALWARE Observed TA453 Related Domain in TLS SNI rev 1 2024-05-06
suricata ET MALWARE DNS Query to TA453 Domain rev 1 2024-05-06
suricata ET HUNTING SUSPICIOUS *.doc.exe in HTTP HEADER rev 13 2024-05-06
suricata ET WEB_SPECIFIC_APPS Plogger phpThumb.php w Parameter Remote File Disclosure Attempt rev 7 2024-05-06
suricata ET INFO StumbleUpon Submission Detected rev 6 2024-05-06
suricata ET MALWARE Observed TA453 Domain in TLS SNI rev 1 2024-05-06
suricata ET WEB_SPECIFIC_APPS PithCMS oldnews_reader.php lang Parameter Local File Inclusion Attempt rev 6 2024-05-06
suricata ET INFO Akamai NetSession Interface PUTing data rev 4 2024-05-06
suricata ET HUNTING SUSPICIOUS *.pdf.exe in HTTP HEADER rev 12 2024-05-06
suricata ET HUNTING Suspicious Invalid HTTP Accept Header of ? rev 6 2024-05-06
suricata ET HUNTING EXE Download With Content Type Specified As Empty rev 8 2024-05-06
suricata ET COINMINER Bitcoin Mining Extensions Header rev 7 2024-05-06
suricata ET MALWARE UPDATE Protocol Trojan Communication detected on non-http ports 2 rev 8 2024-05-06
suricata ET MALWARE TA453 Related Domain in DNS Lookup rev 1 2024-05-06
suricata ET MALWARE Trojan.MyDNS DNSChanger - HTTP POST rev 9 2024-05-06
suricata ET MALWARE DNS Query to TA453 Domain rev 1 2024-05-06
suricata ET MALWARE Observed TA453 Domain in TLS SNI rev 1 2024-05-06
suricata ET MALWARE AntiVirus exe Download Likely FakeAV Install rev 10 2024-05-06
suricata ET MALWARE UPDATE Protocol Trojan Communication detected on http ports 2 rev 7 2024-05-06
suricata ET MALWARE Known Sinkhole Response Header rev 6 2024-05-06
suricata ET MALWARE PyRation Variant - Action Sent to Client rev 2 2024-05-05
suricata ET MALWARE Suspected Powershell Empire POST M1 rev 8 2024-05-05
suricata ET MALWARE Win32.Drun Checkin rev 6 2024-05-05
suricata ET EXPLOIT_KIT Parrot TDS Malicious Response M2 rev 2 2024-05-05
suricata ET HUNTING Suspicious POST Format rev 3 2024-05-05
suricata ET MALWARE PyRation Variant - Command Sent to Client rev 2 2024-05-05
suricata ET EXPLOIT_KIT Parrot TDS Cleared Response M2 rev 2 2024-05-05
suricata ET EXPLOIT_KIT Parrot TDS NDSW Check M2 rev 2 2024-05-05
snort ET CURRENT_EVENTS RIG EK URI Struct Jun 13 2017 rev 2 2024-05-04
suricata ET MALWARE Win32/Rodecap/Travle/PYLOT CnC Checkin M2 rev 6 2024-05-04
suricata ET MALWARE Suspected USBFERRY CnC rev 3 2024-05-04
suricata ET MALWARE Win32/Agent.XST Checkin rev 6 2024-05-04
suricata ET MALWARE BACKCONFIG CnC Downloader Activity rev 4 2024-05-04