Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE TA455 CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Lunar Builder Exfil Response rev 3 2024-03-25
suricata ET WEB_SERVER Automated Site Scanning for backupdata rev 8 2024-03-25
suricata ET HUNTING Telegram API Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Observed DNS Query to WHO Themed Malware Delivery Domain rev 3 2024-03-25
suricata ET MALWARE lu0bot CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET EXPLOIT Possible Uniview IPC2322lb updatecpld Restricted Shell Bypass Attempt rev 1 2024-03-25
suricata ET MALWARE TA455 Related CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET HUNTING Suspicious Request to iplogger .org Contains Period rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Possible W32/KanKan tools.ini Request rev 6 2024-03-25
suricata ET MALWARE TA455 CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Magecart CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE ComRAT CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Observed DNS Query for APT40 Possible DADSTACHE CnC Domain rev 3 2024-03-25
suricata ET MALWARE Observed DNS Query to known Avaddon Ransomware Payment Domain rev 4 2024-03-25
suricata ET HUNTING Suspicious Use of rzd URL Shortener Service rev 2 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET ADWARE_PUP Observed DNS Query to Malvertising Related Domain rev 3 2024-03-25
suricata ET MALWARE W32/Banload.VZS Banker POST CnC Beacon 1 rev 5 2024-03-25
suricata ET MALWARE Observed DNS Query to Vicious Panda CnC Domain rev 3 2024-03-25
suricata ET ADWARE_PUP Socelars Related Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE RegSubsDat Checkin rev 8 2024-03-25
suricata ET MALWARE lu0bot CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE BAZAR CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Win32.Raccoon Stealer CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MOBILE_MALWARE Possible Phenakite User-Agent rev 2 2024-03-25
suricata ET MALWARE Thallium CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Kimsuky APT CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Suspected APT32/OceanLotus Activity rev 2 2024-03-25
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET ADWARE_PUP Win32/TrojanDownloader.Agent.BXA CnC Activity rev 2 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE APT28/SkinnyBoy Checkin rev 3 2024-03-25
suricata ET MALWARE PHP Skimmer Exfil Attempt rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup rev 3 2024-03-25