Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE MSIL/SamMiner CnC Checkin M1 rev 4 2024-04-20
snort ET TROJAN TA577 Payload Delivery Attempt rev 1 2024-04-19
snort ET TROJAN Possible SSload Interactive Shell whoami Output rev 1 2024-04-19
suricata ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain rev 5 2024-04-19
suricata ET INFO Query for a Suspicious *.noc.su domain rev 6 2024-04-19
suricata ET MALWARE Possible SSload Interactive Shell whoami Output rev 1 2024-04-19
suricata ET MALWARE TA577 Payload Delivery Attempt rev 1 2024-04-19
suricata ET SCAN DNS Query for allports.exposed rev 2 2024-04-19
suricata ET MALWARE Possible SSLoad Interactive Shell Connection rev 1 2024-04-19
suricata ET MALWARE H1N1 Loader CnC Beacon M2 rev 5 2024-04-19
suricata ET INFO Query to a *.opengw.net Open VPN Relay Domain rev 9 2024-04-19
suricata ET INFO RealThinClient Outbound Communication rev 7 2024-04-19
suricata ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain rev 5 2024-04-19
suricata ET MALWARE Win32/ArtraDownloader Checkin rev 4 2024-04-19
suricata ET INFO Pastebin-style service note .youdao .com in DNS query rev 3 2024-04-19
suricata ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain rev 5 2024-04-19
suricata ET MALWARE Win32/ArtraDownloader Checkin rev 5 2024-04-19
suricata ET MALWARE H1N1 Loader CnC Beacon M1 rev 6 2024-04-19
suricata ET MALWARE Suspected Monero Miner CnC Channel Secondary Domain Lookup rev 4 2024-04-19
snort ET CURRENT_EVENTS Spelevo EK Flash Exploit Attempt rev 3 2024-04-18
snort ET CURRENT_EVENTS Successful My ADP Phish Feb 16 2017 rev 1 2024-04-18
snort ET CURRENT_EVENTS Successful Apple iCloud Phish May 08 2017 rev 1 2024-04-18
suricata ET PHISHING Possible Yahoo Phishing Landing - Title over non SSL rev 4 2024-04-18
suricata ET MALWARE Win32/Unk.VBScript Requesting Instruction from CnC rev 4 2024-04-18
suricata ET MALWARE Known Sinkhole Response Header rev 2 2024-04-18
suricata ET MALWARE Win32/RisePro CnC Server Response M4 rev 4 2024-04-18
suricata ET INFO Simplehelp Remote Administration Suite HTTP Server Value in Response rev 2 2024-04-18
suricata ET PHISHING Successful Apple iCloud Phish May 08 2017 rev 5 2024-04-18
suricata ET PHISHING Possible CIBC Phishing Landing - Title over non SSL rev 4 2024-04-18
suricata ET PHISHING Successful My ADP Phish Feb 16 2017 rev 5 2024-04-18
suricata ET MALWARE W32/Kazy.325252 Variant CnC Beacon 1 rev 6 2024-04-18
suricata ET MALWARE ArtraDownloader CnC Checkin rev 3 2024-04-18
suricata ET PHISHING Possible Yahoo Phishing Landing - Title over non SSL rev 4 2024-04-18
suricata ET EXPLOIT_KIT Spelevo EK Flash Exploit Attempt rev 5 2024-04-18
suricata ET MALWARE MSIL/SkidRat CnC Checkin M2 rev 5 2024-04-18
suricata ET MALWARE Observed Buran Ransomware UA rev 6 2024-04-18
suricata ET MALWARE Smart Fortress FakeAV/Kryptik.ABNC Checkin rev 6 2024-04-18
suricata ET MALWARE ELF/Muhstik Scanner Module Activity rev 3 2024-04-18
suricata ET MALWARE W32/Kazy.325252 Variant CnC Beacon 2 rev 7 2024-04-18
suricata ET MALWARE Operation Cobra Venom WSF Stage 1 - CnC Checkin rev 4 2024-04-18