Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Observed OSX/Silver Sparrow Download Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Suspected TeamTNT Linux Miner Activity rev 2 2024-03-25
suricata ET EXPLOIT WP Download From Files Plugin <= 1.48 Arbitrary File Upload Attempt rev 2 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE ASNAROK CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Buer Loader Successful Payload Download rev 4 2024-03-25
suricata ET MALWARE Observed DNS Query to Vicious Panda CnC Domain rev 3 2024-03-25
suricata ET MALWARE BAZAR CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET ADWARE_PUP Socelars Related Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE lu0bot Loader HTTP Request rev 2 2024-03-25
suricata ET EXPLOIT_KIT PurpleFox EK Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE W32/Banload.VZS Banker POST CnC Beacon 1 rev 5 2024-03-25
suricata ET MALWARE Win32.Raccoon Stealer CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MOBILE_MALWARE ITW Android Post-Exploit Downloader CnC Activity rev 3 2024-03-25
suricata ET MALWARE IXWARE Stealer Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET ADWARE_PUP Observed DNS Query to Malvertising Related Domain rev 3 2024-03-25
suricata ET ADWARE_PUP Win32/TrojanDownloader.Agent.BXA CnC Activity rev 2 2024-03-25
suricata ET MOBILE_MALWARE Possible Phenakite User-Agent rev 2 2024-03-25
suricata ET MALWARE Observed DNS Query for APT40 Possible DADSTACHE CnC Domain rev 3 2024-03-25
suricata ET HUNTING Suspicious Use of rzd URL Shortener Service rev 2 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed DNS Query to Vicious Panda CnC Domain rev 3 2024-03-25
suricata ET MALWARE Fake ProtonVPN/AZORult CnC Domain Query rev 3 2024-03-25
suricata ET INFO Wifi Geolocation Lookup Attempt rev 2 2024-03-25
suricata ET MALWARE W32/StealRat.SpamBot Email Template Request rev 5 2024-03-25
suricata ET MALWARE ComRAT CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE RedDelta Poison Ivy Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE NSIS/TrojanDownloader.Agent.NZK CnC Activity M1 rev 3 2024-03-25
suricata ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Query for Known Hostile *test.3322.org.cn Domain rev 2 2024-03-25
suricata ET MALWARE RedDelta Poison Ivy Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Kimsuky APT CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Kimsuky APT CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE BOUNCEBEAM Backdoor CnC Activity rev 2 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed DNS Query to WHO Themed Malware Delivery Domain rev 3 2024-03-25