Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Win32/Backdoor.Daxin CnC Activity rev 3 2024-04-03
suricata ET MALWARE MegalodonHTTP/LuciferHTTP/Gomorrah Client Action M2 rev 3 2024-04-03
suricata ET MALWARE TontoTeam APT Related Bisonal CnC Activity rev 3 2024-04-03
suricata ET MALWARE Gamaredon APT Backdoor Related Activity rev 2 2024-04-03
suricata ET MALWARE ReVBShell Command Response rev 3 2024-04-03
suricata ET MALWARE [ANY.RUN] Konni.APT Exfiltration rev 3 2024-04-03
suricata GPL ATTACK_RESPONSE id check returned nobody rev 9 2024-04-03
suricata ET MALWARE Win32/frebniis IIS Backdoor Trigger Attempt M2 rev 2 2024-04-03
suricata ET CURRENT_EVENTS Possible Crypto Drainer Fetch rev 3 2024-04-03
suricata ET MALWARE Win32/Zegost!ml CnC Checkin rev 3 2024-04-03
suricata ET INFO Empty POST with Terse Headers Over Non Standard Port rev 3 2024-04-03
suricata ET MALWARE Trojan-PSW.Win32.Stealer.sb CnC rev 3 2024-04-03
suricata GPL ATTACK_RESPONSE file copied ok rev 15 2024-04-03
suricata ET MALWARE Win32/frebniis IIS Backdoor Trigger Attempt M1 rev 2 2024-04-03
suricata ET MALWARE Suspected APT34 Related SSD Backdoor Response rev 2 2024-04-03
suricata ET MALWARE SnappyTCP Reverse Shell Client Checkin M1 rev 3 2024-04-03
suricata ET MALWARE Win32/VB.QPK CnC Checkin rev 2 2024-04-03
suricata ET MALWARE Win32.Agent.Y!c CnC Checkin rev 2 2024-04-03
suricata ET MALWARE Win32/Sventore.B CnC Checkin rev 2 2024-04-03
suricata ET MALWARE VBA/Agent.ADT Checkin rev 2 2024-04-03
suricata ET MALWARE Villain C2 Framework HTTP Server Response rev 2 2024-04-03
suricata ET MALWARE TA421 Wineloader CnC Checkin M4 rev 3 2024-04-03
suricata ET EXPLOIT_KIT Parrot TDS Check M2 rev 2 2024-04-03
suricata ET EXPLOIT_KIT Parrot TDS Cleared Response rev 3 2024-04-03
suricata ET PHISHING Tech Support/Refund Scam Landing Inbound 2022/04/25 rev 3 2024-04-03
suricata GPL ATTACK_RESPONSE command completed rev 14 2024-04-03
suricata ET PHISHING Manhattan College Phish Landing Page 2022-01-10 rev 2 2024-04-03
suricata ET MALWARE Win32/Wacapew.C!ml CnC Checkin rev 2 2024-04-03
suricata ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity rev 1 2024-04-03
snort ET INFO Possible External IP Check rev 1 2024-04-01
suricata ET MALWARE APT CozyCar SSL Cert 3 rev 5 2024-04-01
suricata ET MALWARE CozyDuke APT Possible SSL Cert 7 rev 5 2024-04-01
elastic Deprecated - Remote File Creation on a Sensitive Directory deprecated 2024-04-01
snort ET TROJAN Linux/Dinodas RAT CnC Checkin - UDP rev 1 2024-03-29
snort ET TROJAN Linux/Dinodas RAT CnC Checkin - TCP rev 1 2024-03-29
suricata ET MALWARE Linux/Dinodas RAT CnC Checkin - UDP rev 1 2024-03-29
suricata ET MALWARE Linux/Dinodas RAT CnC Checkin - TCP rev 1 2024-03-29
snort ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 rev 1 2024-03-28
snort ET TROJAN Large DNS Query possible covert channel rev 10 2024-03-28
snort ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M2 rev 1 2024-03-28