Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Smanager CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice POST] rev 4 2024-03-25
suricata ET MALWARE Win32/Backdoor.Dripion External IP Check rev 5 2024-03-25
suricata ET MALWARE TA455 Related CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE NSIS/TrojanDownloader.Agent.NZK CnC Activity M1 rev 3 2024-03-25
suricata ET MALWARE GCleaner Downloader Activity M4 rev 3 2024-03-25
suricata ET MALWARE Smanager CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET ADWARE_PUP SuperAntiSpyware Install Checkin rev 2 2024-03-25
suricata ET MALWARE HabitsRAT Checkin rev 2 2024-03-25
suricata ET MALWARE MAZE Ransomware Payment Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE RedDelta Poison Ivy Domain in DNS Lookup rev 3 2024-03-25
suricata ET EXPLOIT_KIT Possible PurpleFox EK Framework URI Struct Payload Request M1 rev 3 2024-03-25
suricata ET ADWARE_PUP ThunderUnion Install Checkin rev 2 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Spark Backdoor CnC Domain Query rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE DNSChanger CnC Domain in DNS Lookup rev 5 2024-03-25
suricata ET ADWARE_PUP Win32/Adware.Agent.NSU CnC Activity M2 rev 2 2024-03-25
sigma Service Binary in User Controlled Folder test 2024-03-25
sigma New PortProxy Registry Entry Added test 2024-03-25
sigma Run Once Task Configuration in Registry test 2024-03-25
sigma Add Port Monitor Persistence in Registry test 2024-03-25
sigma Windows Defender Service Disabled - Registry test 2024-03-25
sigma Default RDP Port Changed to Non Standard Port test 2024-03-25
sigma Sysmon Driver Altitude Change test 2024-03-25
sigma Change Winevt Channel Access Permission Via Registry test 2024-03-25
sigma Disable Administrative Share Creation at Startup test 2024-03-25
sigma Disable Windows Event Logging Via Registry test 2024-03-25
sigma Disable Microsoft Defender Firewall via Registry test 2024-03-25
sigma Potential CobaltStrike Service Installations - Registry test 2024-03-25
sigma CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry test 2024-03-25
suricata ET MALWARE Observed Get2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed DCRat CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 2 2024-03-24
suricata ET INFO Dell MyWay Remote control agent rev 7 2024-03-24
suricata ET MALWARE FakeAV User-Agent XML rev 5 2024-03-24