Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET HUNTING SUSPICIOUS DOC Download from commonly abused file share site rev 6 2024-04-30
suricata ET HUNTING Request to 000webhostapp Domain with Minimal Headers rev 4 2024-04-30
suricata ET MALWARE Win32/Delf.TJJ Variant CnC Activity rev 4 2024-04-30
suricata ET MALWARE Win32/BLUELIGHT OAuth Login Attempt rev 3 2024-04-30
suricata ET MALWARE Win32/RecordBreaker - Library Request rev 3 2024-04-30
suricata ET MALWARE TeleBots BCS-server CnC Beacon rev 5 2024-04-30
suricata ET EXPLOIT_KIT RIG Payload URI Struct March 20 2015 rev 5 2024-04-30
suricata ET MALWARE GCleaner Downloader Activity M5 rev 3 2024-04-30
suricata ET INFO Minimal HTTP GET Request to cl .ly rev 3 2024-04-30
suricata ET HUNTING Terse Request for .txt - Likely Hostile rev 3 2024-04-30
suricata ET MALWARE Observed Buran Ransomware UA rev 4 2024-04-30
suricata ET MALWARE PurpleFox Backdoor/Rootkit Download Server Response M2 rev 4 2024-04-30
suricata ET MALWARE TA402/Molerats CnC Activity rev 5 2024-04-30
suricata ET ADWARE_PUP SecureDriverUpdater Checkin rev 4 2024-04-30
suricata ET MALWARE Possible MEME#4CHAN Exfil Activity rev 3 2024-04-30
suricata ET MALWARE AgentTesla PWS HTTP CnC Checkin rev 7 2024-04-30
suricata ET MALWARE Win32/BLUELIGHT OAuth Login Attempt M2 rev 4 2024-04-30
suricata ET HUNTING jpg download from fileupload .site rev 3 2024-04-30
suricata ET MALWARE Bazaloader Variant Activity rev 3 2024-04-30
suricata ET ADWARE_PUP Win32 Handy Cafe Checkin rev 3 2024-04-30
suricata ET MALWARE EVILNUM CnC Connectivity Check rev 4 2024-04-30
suricata ET MALWARE JS/GootLoader CnC Exfil rev 4 2024-04-30
suricata ET ADWARE_PUP [PTsecurity] Adware.FileFinder Activity rev 6 2024-04-30
suricata ET MALWARE PurpleFox Backdoor/Rootkit Download Server Response M4 rev 3 2024-04-30
suricata ET EXPLOIT_KIT Possible Broken/Filtered RIG EK Payload Download rev 7 2024-04-30
suricata ET MALWARE BlackEnergy POST Request rev 5 2024-04-30
suricata ET MALWARE Win32/RecordBreaker - Observed UA M2 rev 3 2024-04-30
suricata ET MALWARE Linux/LuaBot CnC Beacon rev 5 2024-04-30
suricata ET MALWARE Win32/Ymacco.AA67 CnC Activity rev 3 2024-04-30
suricata ET HUNTING Request to .CF Domain with Minimal Headers rev 4 2024-04-30
suricata ET MALWARE Maldoc Downloading from Dropbox via API rev 3 2024-04-30
suricata ET MALWARE MSIL/Lightning Stealer Exfil Activity rev 3 2024-04-30
suricata ET MALWARE Win64/Agent.NL Variant CnC Activity rev 3 2024-04-30
suricata ET HUNTING Request to .TOP Domain with Minimal Headers rev 4 2024-04-30
suricata ET INFO Minimal HTTP GET Request to rebrand .ly rev 3 2024-04-30
suricata ET MALWARE KeyLogger related to FindPOS CnC Beacon rev 5 2024-04-30
suricata ET INFO POST to Double Slash in URI rev 4 2024-04-30
suricata ET MALWARE X-Files Stealer CnC Exfil Activity M2 rev 3 2024-04-30
suricata ET MALWARE Suspected ToddyCat APT Curlu Related Activity M1 rev 3 2024-04-30
suricata ET MALWARE IIStealer Inbound Exfil Request rev 3 2024-04-30