Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Xehook Stealer Data Exfiltration Attempt rev 1 2024-03-04
snort ET TROJAN Xehook Stealer CnC Checkin rev 1 2024-03-04
snort ET TROJAN Xehook Stealer CnC Checkin - Server Response rev 1 2024-03-04
suricata ET MALWARE Xehook Stealer CnC Checkin - Server Response rev 1 2024-03-04
sigma Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process test 2024-03-01
snort ET TROJAN TA430/Andariel AndarLoader Related Activity M2 rev 1 2024-02-28
snort ET TROJAN TA430/Andariel NukeSped Backdoor Variant Server Response M2 rev 1 2024-02-28
snort ET TROJAN TA430/Andariel AndarLoader Related Activity M1 rev 1 2024-02-28
snort ET TROJAN Suspected TA430/Andariel AndarLoader Related Domain in TLS SNI rev 1 2024-02-28
snort ET TROJAN TA430/Andariel AndarLoader Related Activity M3 rev 1 2024-02-28
snort ET TROJAN TA430/Andariel NukeSped Backdoor Variant Activity M1 rev 1 2024-02-28
snort ET TROJAN TA430/Andariel NukeSped Backdoor Variant Server Response M1 rev 1 2024-02-28
snort ET TROJAN TA430/Andariel Related Domain in DNS Lookup rev 1 2024-02-28
snort ET TROJAN Suspected TA430/Andariel AndarLoader Related CnC Domain in DNS Lookup rev 1 2024-02-28
snort ET TROJAN TA430/Andariel NukeSped Backdoor Variant Activity M2 rev 1 2024-02-28
suricata ET MALWARE TA430/Andariel NukeSped Backdoor Variant Activity M2 rev 1 2024-02-28
suricata ET MALWARE TA430/Andariel AndarLoader Related Activity M2 rev 1 2024-02-28
suricata ET MALWARE TA430/Andariel NukeSped Backdoor Variant Server Response M1 rev 1 2024-02-28
suricata ET MALWARE Suspected TA430/Andariel AndarLoader Related Domain in TLS SNI rev 1 2024-02-28
suricata ET MALWARE Suspected TA430/Andariel AndarLoader Related CnC Domain in DNS Lookup rev 1 2024-02-28
suricata ET MALWARE TA430/Andariel AndarLoader Related Activity M3 rev 1 2024-02-28
suricata ET MALWARE TA430/Andariel Related Domain in DNS Lookup rev 1 2024-02-28
suricata ET MALWARE TA430/Andariel NukeSped Backdoor Variant Server Response M2 rev 1 2024-02-28
suricata ET MALWARE TA430/Andariel AndarLoader Related Activity M1 rev 1 2024-02-28
suricata ET MALWARE TA430/Andariel NukeSped Backdoor Variant Activity M1 rev 1 2024-02-28
sigma Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution test 2024-02-28
snort ET TROJAN Unknown Powershell Malvertising Payload CnC Checkin rev 1 2024-02-27
snort ET INFO Suspected Andariel/TA430 Related Domain in TLS SNI rev 1 2024-02-27
snort ET INFO Suspected Andariel/TA430 Related Domain in TLS SNI rev 1 2024-02-27
suricata ET MALWARE Unknown Powershell Malvertising Payload CnC Checkin rev 1 2024-02-27
suricata ET HUNTING Suspected Andariel/TA430 Related Domain in TLS SNI rev 1 2024-02-27
suricata ET HUNTING Suspected Andariel/TA430 Related Domain in TLS SNI rev 1 2024-02-27
snort ET TROJAN PyRation Variant - Command Sent to Client rev 1 2024-02-26
snort ET TROJAN PyRation Variant - Configuration Response rev 1 2024-02-26
snort ET TROJAN DNS Query to Lactrodectus Domain rev 1 2024-02-26
snort ET TROJAN DNS Query to Lactrodectus Domain rev 1 2024-02-26
snort ET TROJAN PyRation Variant - Configuration Request rev 1 2024-02-26
snort ET TROJAN PyRation Variant - Action Sent to Client rev 1 2024-02-26
suricata ET MALWARE DNS Query to Lactrodectus Domain rev 1 2024-02-26
suricata ET MALWARE Observed Lactrodectus Domain in TLS SNI rev 1 2024-02-26