Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET ADWARE_PUP PUP/SpamFighter CnC Request rev 2 2024-03-26
suricata ET INFO Keweon Center DNS Over HTTPS Certificate Inbound rev 2 2024-03-26
sigma Displaying Hidden Files Feature Disabled test 2024-03-26
sigma Register New IFiltre For Persistence test 2024-03-26
sigma New TimeProviders Registered With Uncommon DLL Name test 2024-03-26
sigma New Root Certificate Authority Added test 2024-03-26
sigma Kubernetes Secrets Enumeration test 2024-03-26
sigma New Kubernetes Service Account Created test 2024-03-26
sigma Certificate-Based Authentication Enabled test 2024-03-26
sigma Potential Sidecar Injection Into Running Deployment test 2024-03-26
sigma Kubernetes Events Deleted test 2024-03-26
sigma Deployment Deleted From Kubernetes Cluster test 2024-03-26
sigma RBAC Permission Enumeration Attempt test 2024-03-26
sigma Creation Of Pod In System Namespace test 2024-03-26
sigma Container With A hostPath Mount Created test 2024-03-26
sigma Potential Remote Command Execution In Pod Container test 2024-03-26
sigma Privileged Container Deployed test 2024-03-26
snort ET TROJAN Known Hostile Domain citi-bank.ru Lookup rev 5 2024-03-25
snort ET EXPLOIT Possible Uniview IPC2322lb updatecpld Restricted Shell Bypass Attempt rev 1 2024-03-25
suricata ET MALWARE Possible W32/KanKan tools.ini Request rev 6 2024-03-25
suricata ET HUNTING HTTP Request for OpenNIC API GeoIP Request rev 2 2024-03-25
suricata ET MALWARE Parallax RAT CnC Domain Observed in DNS Query rev 3 2024-03-25
suricata ET MALWARE Win32/Sinresby.B Downloader CnC Activity M1 rev 2 2024-03-25
suricata ET MOBILE_MALWARE PHANTOMLANCE CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Suspected APT32/OceanLotus Activity rev 2 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Fake ProtonVPN/AZORult CnC Domain Query rev 3 2024-03-25
suricata ET MALWARE ComRAT CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Observed DNS Query to Vicious Panda CnC Domain rev 3 2024-03-25
suricata ET MALWARE APT28/SkinnyBoy Checkin rev 3 2024-03-25
suricata ET MALWARE W32/StealRat.SpamBot Email Template Request rev 5 2024-03-25
suricata ET EXPLOIT Ubiquiti Networks UniFi Cloud Key Firm v0.6.1 Host Remote Command Execution attempt rev 5 2024-03-25
suricata ET MALWARE Observed DNS Query to known Avaddon Ransomware Payment Domain rev 4 2024-03-25
suricata ET MALWARE SparklingGoblin/Winnti Group SideWalk Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE PHP Skimmer Exfil Attempt rev 3 2024-03-25
suricata ET INFO Wifi Geolocation Lookup Attempt rev 2 2024-03-25
suricata ET MALWARE Magecart CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25