Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET ADWARE_PUP W32/OnlineGames Checkin rev 7 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET MALWARE Observed TrojanSpy.SH.HADGLIDER.A Exfil Domain in DNS Query rev 2 2024-03-24
suricata ET ADWARE_PUP InstallCore PUA/Adware Activity M4 rev 5 2024-03-24
suricata ET MALWARE Win32/Beapy CnC Domain in DNS Lookup rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE EvilNum CnC Checkin Response rev 2 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed Glupteba CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET WEB_SPECIFIC_APPS Attempted Symantec Secure Web Gateway RCE rev 2 2024-03-24
suricata ET MALWARE EvilNum CnC Client Data Exfil rev 2 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed VikroStealer CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed Ursnif Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE ASNAROK Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 3 2024-03-24
suricata ET MALWARE Hisoka CnC Domain Observed in DNS Query rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed APT/SideWinder CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed VikroStealer CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET EXPLOIT Attempted Netgear Buffer Overflow into RCE Inbound M1 rev 2 2024-03-24
suricata ET MALWARE CommentCrew Possible APT backdoor download logo.png rev 7 2024-03-24
suricata ET MALWARE Observed CobInt CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET MALWARE W32/Numnet.Downloader CnC Checkin 2 rev 4 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE DEEP PANDA Checkin 1 rev 7 2024-03-24
suricata ET MALWARE EvilNum CnC Client Data Exfil rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 3 2024-03-24