Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Powershell commands sent B64 2 rev 5 2024-04-06
suricata ET MALWARE Backdoor.Elise CnC Beacon 2 M2 rev 7 2024-04-06
suricata ET MALWARE Possible Sharik/Smoke Loader Microsoft Connectivity check M2 rev 4 2024-04-06
snort ET INFO Request to 000webhostapp Domain with Minimal Headers rev 3 2024-04-05
snort ET TROJAN Suspected Parallax RAT Checkin rev 1 2024-04-05
snort ET INFO Request to .GQ Domain with Minimal Headers rev 3 2024-04-05
snort ET INFO Request to .ML Domain with Minimal Headers rev 3 2024-04-05
snort ET INFO Request to .CF Domain with Minimal Headers rev 3 2024-04-05
snort ET INFO Request to .GA Domain with Minimal Headers rev 3 2024-04-05
snort ET INFO Request to .TOP Domain with Minimal Headers rev 3 2024-04-05
snort ET INFO Request to .XYZ Domain with Minimal Headers rev 3 2024-04-05
snort ET INFO Request to .TK Domain with Minimal Headers rev 3 2024-04-05
suricata ET HUNTING Suspicious POST Format rev 3 2024-04-05
suricata ET INFO Dotted Quad Host PPTX Request rev 6 2024-04-05
suricata ET MALWARE Hades APT Downloader Attempting to Retrieve Stage 2 Payload rev 4 2024-04-05
suricata ET MALWARE Octopus Malware CnC Activity rev 3 2024-04-05
suricata ET MALWARE Suspected Parallax RAT Checkin rev 1 2024-04-05
suricata ET INFO Minimal HTTP GET Request to Bit.ly rev 4 2024-04-05
suricata ET INFO Dotted Quad Host TGZ Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host PDF Request rev 7 2024-04-05
suricata ET INFO Dotted Quad Host PS Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host HTA Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host PPT Request rev 6 2024-04-05
suricata ET MALWARE Possible Sharik/Smoke Loader 7zip Connectivity Check rev 4 2024-04-05
suricata ET INFO Dotted Quad Host DLL Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host VBS Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host GZ Request rev 6 2024-04-05
suricata ET HUNTING Suspicious POST Format rev 3 2024-04-05
suricata ET INFO Dotted Quad Host DOC Request rev 7 2024-04-05
suricata ET INFO Dotted Quad Host DOCX Request rev 6 2024-04-05
suricata ET INFO Chocolatey Windows Package Management Installation File Retrieval rev 3 2024-04-05
suricata ET INFO Dotted Quad Host XLS Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host RTF Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host RAR Request rev 6 2024-04-05
suricata ET MALWARE [PTsecurity] Win32/Spy.RTM/Redaman IP Check rev 6 2024-04-05
suricata ET INFO Dotted Quad Host ZIP Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host XLSX Request rev 6 2024-04-05
sigma Invoke-Obfuscation VAR+ Launcher - PowerShell test 2024-04-05
sigma Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell test 2024-04-05
sigma Invoke-Obfuscation STDIN+ Launcher - Powershell test 2024-04-05