Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN PikaBot Java Loader CnC Checkin rev 1 2024-02-13
snort ET INFO DNS Query to a *giize.com DYNAMIC_DNS Domain rev 1 2024-02-13
snort ET TROJAN [ANY.RUN] Meduza Stealer Exfiltration M2 rev 1 2024-02-13
suricata ET MALWARE Synapse/Lambda Ransomware CnC Checkin rev 1 2024-02-13
suricata ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 rev 1 2024-02-13
suricata ET HUNTING Redirect to Wikipedia with Hackernoon GIF rev 1 2024-02-13
suricata ET MALWARE PikaBot Java Loader CnC Checkin rev 1 2024-02-13
snort ET CURRENT_EVENTS Generic Phish Landing Page 2024-02-12 rev 1 2024-02-12
snort ET CURRENT_EVENTS Observed Phishing Related Domain [Redacted - Vulgar] rev 1 2024-02-12
snort ET CURRENT_EVENTS Observed DNS Query to Phishing Related Domain [Redacted - Vulgar] rev 1 2024-02-12
snort ET CURRENT_EVENTS Successful Generic Phish 2024-02-12 rev 1 2024-02-12
suricata ET PHISHING Observed DNS Query to Phishing Related Domain [Redacted - Vulgar] rev 1 2024-02-12
suricata ET PHISHING Observed Phishing Related Domain [Redacted - Vulgar] rev 1 2024-02-12
suricata ET PHISHING Generic Phish Landing Page 2024-02-12 rev 1 2024-02-12
suricata ET PHISHING Successful Generic Phish 2024-02-12 rev 1 2024-02-12
sigma Interesting Service Enumeration Via Sc.EXE test 2024-02-12
snort ET TROJAN MacOS/Adload Proxy Node Beacon rev 2 2024-02-09
suricata ET MALWARE MacOS/Adload Proxy Node Beacon rev 2 2024-02-09
sigma External Disk Drive Or USB Storage Device Was Recognized By The System test 2024-02-09
sigma Outbound RDP Connections Over Non-Standard Tools test 2024-02-09
sigma Uncommon Service Installation Image Path test 2024-02-09
sigma SC.EXE Query Execution test 2024-02-08
sigma Potential Fake Instance Of Hxtsr.EXE Executed test 2024-02-08
sigma Exploitation Indicator Of CVE-2022-42475 test 2024-02-08
sigma Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate test 2024-02-08
snort ET INFO Googlebot User-Agent Observed in Outbound HTTP Request rev 1 2024-02-07
snort ET INFO [ANY.RUN] DARKCLOUD Style External IP Check rev 2 2024-02-07
snort ET TROJAN Lumma Stealer Related Activity rev 2 2024-02-07
suricata ET HUNTING Googlebot User-Agent Observed in Outbound HTTP Request rev 1 2024-02-07
snort ET TROJAN Suspected TA451 Related FalseFont Backdoor Activity M1 rev 2 2024-02-05
snort ET TROJAN Suspected TA451 Related FalseFont Backdoor Activity M5 rev 3 2024-02-05
snort ET TROJAN Suspected TA451 Related FalseFont Backdoor Activity M3 rev 2 2024-02-05
snort ET INFO AnyDesk Revoked Code Signing Certificate Observed rev 1 2024-02-05
snort ET TROJAN Suspected TA451 Related FalseFont Backdoor Activity M2 rev 3 2024-02-05
suricata ET MALWARE Suspected TA451 Related FalseFont Backdoor Activity M1 rev 2 2024-02-05
suricata ET MALWARE Suspected TA451 Related FalseFont Backdoor Activity M2 rev 3 2024-02-05
suricata ET MALWARE Suspected TA451 Related FalseFont Backdoor Activity M3 rev 2 2024-02-05
sigma Self Extraction Directive File Created In Potentially Suspicious Location test 2024-02-05
sigma Potentially Suspicious Self Extraction Directive File Created test 2024-02-05
sigma New Self Extracting Package Created Via IExpress.EXE test 2024-02-05