Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE EvilNum CnC Client Data Exfil rev 2 2024-03-24
snort ET MOBILE_MALWARE Trojan-Dropper.AndroidOS.Anatsa Checkin rev 2 2024-03-22
sigma Suspicious DNS Query for IP Lookup Service APIs test 2024-03-22
sigma Potential KamiKakaBot Activity - Lure Document Execution test 2024-03-22
sigma Potential KamiKakaBot Activity - Winlogon Shell Persistence test 2024-03-22
sigma Suspicious Network Connection to IP Lookup Service APIs test 2024-03-22
sigma Potential KamiKakaBot Activity - Shutdown Schedule Task Creation test 2024-03-22
snort ET MOBILE_MALWARE Android Vultr Checkin rev 2 2024-03-21
snort ET TROJAN Possible HijackLoader Second Stage PNG Retrieval rev 1 2024-03-21
snort ET TROJAN TA402/Molerats CnC Activity rev 2 2024-03-21
suricata ET MALWARE Possible HijackLoader Second Stage PNG Retrieval rev 1 2024-03-21
snort ET TROJAN Win32/IDAT Loader Related Activity rev 1 2024-03-20
suricata ET MALWARE Suspected Agent Racoon Backdoor DNS Related Activity rev 1 2024-03-20
sigma CVE-2024-1212 Exploitation - Progress Kemp LoadMaster Unauthenticated Command Injection test 2024-03-20
sigma FlowCloud Registry Markers test 2024-03-20
sigma Office Macros Warning Disabled test 2024-03-19
sigma MaxMpxCt Registry Value Changed test 2024-03-19
sigma Potentially Suspicious CMD Shell Output Redirect test 2024-03-19
sigma CMD Shell Output Redirect test 2024-03-19
sigma Suspicious Command Patterns In Scheduled Task Creation test 2024-03-19
sigma Add SafeBoot Keys Via Reg Utility test 2024-03-19
snort ET INFO Base64 Encoded Executable over Raw TCP rev 1 2024-03-18
snort ET CURRENT_EVENTS Generic Phish Landing Page 2024-03-18 rev 1 2024-03-18
suricata ET MALWARE JS/Comm100 Trojan CnC Payload Inbound rev 3 2024-03-18
suricata ET SCAN Exabot Webcrawler User Agent rev 3 2024-03-18
suricata ET PHISHING Generic Phish Landing Page 2024-03-18 rev 1 2024-03-18
suricata ET HUNTING Base64 Encoded Executable over Raw TCP rev 1 2024-03-18
suricata ET SCAN AOL Webcrawler User-Agent rev 2 2024-03-18
suricata ET ATTACK_RESPONSE FTP inaccessible directory access LPT2 rev 9 2024-03-17
suricata ET MALWARE IMDDOS Botnet User-Agent STORMDDOS rev 8 2024-03-17
suricata ET P2P Soulseek rev 10 2024-03-17
suricata ET MALWARE [PTsecurity] MZRevenge Ransomware Server Response rev 3 2024-03-17
suricata ET CHAT IRC authorization message rev 6 2024-03-17
suricata ET P2P Phatbot Control Connection rev 7 2024-03-17
suricata ET ADWARE_PUP Context Plus Spyware Install rev 11 2024-03-17
suricata ET WEB_SERVER Recon-ng User-Agent rev 5 2024-03-17
suricata ET HUNTING Suspicious Windows NT version 8 User-Agent rev 8 2024-03-17
suricata ET P2P Gnutella Connect rev 8 2024-03-17
suricata ET ATTACK_RESPONSE FTP inaccessible directory access NULL rev 9 2024-03-17