Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Possible Generic RAT over Telegram API rev 3 2024-03-25
suricata ET MALWARE Win32/FakeXPA Checkin URL rev 9 2024-03-25
suricata ET MOBILE_MALWARE Phenakite Audio Upload CnC rev 3 2024-03-25
suricata ET MALWARE lu0bot CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE RedDelta Poison Ivy Domain in DNS Lookup rev 3 2024-03-25
suricata ET INFO Unix/Linux Processhider Source Being Downloaded rev 2 2024-03-25
suricata ET EXPLOIT Possible Uniview IPC2322lb updatecpld Restricted Shell Bypass Attempt rev 1 2024-03-25
suricata ET MALWARE Linux DarkRadiation Ransomware Activity Attack Check rev 2 2024-03-25
suricata ET EXPLOIT_KIT Possible PurpleFox EK Framework URI Struct Payload Request M1 rev 3 2024-03-25
suricata ET MALWARE SparklingGoblin/Winnti Group SideWalk Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE lu0bot CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE BAZAR CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE DNSChanger CnC Domain in DNS Lookup rev 5 2024-03-25
suricata ET MALWARE TA455 CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE lu0bot CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Fake Software Download Redirect Leading to Malware M2 rev 3 2024-03-25
suricata ET MALWARE APT/Bitter Related CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Lemon_Duck CnC Activity rev 2 2024-03-25
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed DNS Query to Vicious Panda CnC Domain rev 3 2024-03-25
suricata ET MALWARE W32/BlackEnergy Dirconf CnC Beacon rev 5 2024-03-25
suricata ET MALWARE Observed DNS Query to known Avaddon Ransomware Payment Domain rev 4 2024-03-25
suricata ET MALWARE W32/Banload.VZS Banker POST CnC Beacon 1 rev 5 2024-03-25
suricata ET MALWARE ThiefQuest CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Kimsuky APT CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET ADWARE_PUP Socelars Related Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE RegSubsDat Checkin rev 8 2024-03-25
suricata ET MALWARE Win32.Raccoon Stealer CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE MSIL/Agent.DNL CnC Activity M1 rev 2 2024-03-25
suricata ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE indux.php check-in rev 9 2024-03-25
suricata ET MALWARE Win32/Sinresby.B Downloader CnC Activity M1 rev 2 2024-03-25
suricata ET MALWARE Possible SQUIRRELWAFFLE Server Response rev 3 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET WEB_SERVER Automated Site Scanning for backupdata rev 8 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25