Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MOBILE_MALWARE Possible Phenakite User-Agent rev 2 2024-03-25
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed DNS Query to Vicious Panda CnC Domain rev 3 2024-03-25
suricata ET MALWARE Observed DNS Query to Stitch C2 Domain rev 3 2024-03-25
suricata ET ADWARE_PUP Socelars Related Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE ComRAT CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE GCleaner Downloader Activity M3 rev 4 2024-03-25
suricata ET MALWARE Observed DNS Query to WHO Themed Malware Delivery Domain rev 3 2024-03-25
suricata ET MALWARE Win32.Raccoon Stealer CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE BAZAR CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Fake ProtonVPN/AZORult CnC Domain Query rev 3 2024-03-25
suricata ET MALWARE Thallium CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE TA455 CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE IXWARE Stealer Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE PlugX DNS Lookup rev 2 2024-03-25
suricata ET HUNTING Suspicious Use of rzd URL Shortener Service rev 2 2024-03-25
suricata ET MALWARE RegSubsDat Checkin rev 8 2024-03-25
suricata ET MOBILE_MALWARE ITW Android Post-Exploit Downloader CnC Activity rev 3 2024-03-25
suricata ET MALWARE Possible Generic RAT over Telegram API rev 3 2024-03-25
suricata ET MALWARE Suspected DonotGroup Dropper Activity rev 2 2024-03-25
suricata ET MALWARE ComRAT CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Observed DarkSide Ransomware CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MOBILE_MALWARE PHANTOMLANCE CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE MSIL/Agent.DNL CnC Activity M1 rev 2 2024-03-25
suricata ET MALWARE lu0bot CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE TA455 Related CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Observed DNS Query to Stitch C2 Domain rev 3 2024-03-25
suricata ET HUNTING Suspicious Request to iplogger .org Contains Period rev 3 2024-03-25
suricata ET MALWARE lu0bot CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE GCleaner Downloader Activity M1 rev 2 2024-03-25
suricata ET MALWARE Parallax RAT CnC Domain Observed in DNS Query rev 3 2024-03-25
suricata ET EXPLOIT Possible Uniview IPC2322lb updatecpld Restricted Shell Bypass Attempt rev 1 2024-03-25
suricata ET MOBILE_MALWARE Phenakite Audio Upload CnC rev 3 2024-03-25
suricata ET MALWARE TA455 CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Linux DarkRadiation Ransomware Activity Attack Check rev 2 2024-03-25
suricata ET MALWARE lu0bot CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Win32/Bisonal Backdoor CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup rev 3 2024-03-25