Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET USER_AGENTS User-agent DownloadNetFile Win32.small.hsh downloader rev 16 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 2 2024-03-24
suricata ET MALWARE Possible W32/KanKan Update officeaddinupdate.xml Request rev 5 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed Ursnif Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 2 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET MALWARE Win32/Beapy CnC Domain in DNS Lookup rev 2 2024-03-24
suricata ET INFO Observed DeepFreezeWeb User-Agent rev 2 2024-03-24
suricata ET EXPLOIT Attempted Netgear Buffer Overflow into RCE Inbound M2 rev 2 2024-03-24
suricata ET MALWARE CommentCrew Possible APT backdoor download logo.png rev 7 2024-03-24
suricata ET ADWARE_PUP InstallCore PUA/Adware Activity M2 rev 5 2024-03-24
suricata ET INFO Dell MyWay Remote control agent rev 7 2024-03-24
suricata ET INFO Internal Host Retrieving External IP via myip.dnsomatic.com rev 5 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET MALWARE FakeAV User-Agent XML rev 5 2024-03-24
suricata ET MALWARE EvilNum CnC Checkin Response rev 2 2024-03-24
suricata ET MALWARE W32/Numnet.Downloader CnC Checkin 1 rev 4 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Sofacy HTTP Request microsof-update.com rev 3 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 3 2024-03-24
suricata ET MALWARE Observed VikroStealer CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE EvilNum CnC Client Data Exfil rev 2 2024-03-24
suricata ET MALWARE Observed VikroStealer CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 3 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE XcodeGhost CnC Checkin rev 4 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24