Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET DNS DNS Query to a Suspicious *.vv.cc domain rev 3 2024-01-30
snort ET DNS DNS Query for a Suspicious *.ae.am domain rev 3 2024-01-30
snort ET DNS Query for Suspicious .ru.tf Domain rev 3 2024-01-30
snort ET DNS Query for Suspicious .de.tf Domain rev 3 2024-01-30
snort ET INFO DYNAMIC_DNS Query to 3322.net Domain *.7766.org rev 8 2024-01-30
snort ET CURRENT_EVENTS [TW] Possible Crypto Wallet Drainer Domain Observed rev 1 2024-01-30
snort ET DNS Query for Suspicious .net.tf Domain rev 3 2024-01-30
snort ET INFO DYNAMIC_DNS Query to 3322.net Domain *.9966.org rev 7 2024-01-30
snort ET DNS Query for Suspicious .int.tf Domain rev 3 2024-01-30
snort ET INFO DYNAMIC_DNS Query for Suspicious .dyndns-at-home.com Domain rev 5 2024-01-30
snort ET DNS DNS Query for a Suspicious *.be.ma domain rev 5 2024-01-30
snort ET DNS Query for Suspicious .sg.tf Domain rev 3 2024-01-30
snort ET DNS Query for Suspicious .eu.tf Domain rev 3 2024-01-30
snort ET DNS Query for Suspicious .bg.tf Domain rev 3 2024-01-30
snort ET DNS Query for Suspicious .ch.tf Domain rev 3 2024-01-30
snort ET DNS Query for Suspicious .cz.tf Domain rev 3 2024-01-30
snort ET DNS DNS Query for Suspicious .co.cc Domain rev 5 2024-01-30
snort ET TROJAN AllaKore RAT CnC Checkin M1 rev 2 2024-01-30
snort ET DNS Query for Suspicious .us.tf Domain rev 3 2024-01-30
snort ET CURRENT_EVENTS [TW] Possible Crypto Wallet Drainer JS M1 rev 1 2024-01-30
snort ET DNS DNS Query for vpnoverdns - indicates DNS tunnelling rev 4 2024-01-30
snort ET INFO DYNAMIC_DNS Query to 3322.net Domain *.6600.org rev 8 2024-01-30
snort ET INFO DYNAMIC_DNS Query to 3322.net Domain *.3322.net rev 8 2024-01-30
snort ET CURRENT_EVENTS [TW] Possible Crypto Wallet Drainer JS M2 rev 1 2024-01-30
snort ET DNS Query for Suspicious .at.tf Domain rev 3 2024-01-30
snort ET DNS Query for Suspicious .edu.tf Domain rev 3 2024-01-30
snort ET DNS DNS Query for Suspicious .co.be Domain rev 5 2024-01-30
snort ET DNS Query for Suspicious .noip.cn Domain rev 3 2024-01-30
snort ET TROJAN Perl/Calfbot C&C DNS request rev 8 2024-01-30
snort ET INFO DNS Query to a Suspicious *.orge.pl Domain rev 4 2024-01-30
snort ET MOBILE_MALWARE DNS Query for gongfu-android.com DroidKungFu CnC Server rev 4 2024-01-30
snort ET TROJAN [ANY.RUN] WhiteSnake Stealer HTTP Request rev 1 2024-01-30
snort ET DNS DNS Query for a Suspicious *.qc.cx domain rev 3 2024-01-30
snort ET DNS Query for Suspicious .ca.tf Domain rev 3 2024-01-30
snort ET TROJAN DNS Possible User trying to visit POSHCODER.A .onion link outside of torbrowser rev 3 2024-01-30
snort ET INFO DYNAMIC_DNS Query to dns-stuff.com Domain *.dns-stuff.com rev 4 2024-01-30
suricata ET PHISHING [TW] Possible Crypto Wallet Drainer Domain Observed rev 1 2024-01-30
suricata ET PHISHING [TW] Possible Crypto Wallet Drainer JS M1 rev 1 2024-01-30
suricata ET PHISHING [TW] Possible Crypto Wallet Drainer JS M2 rev 1 2024-01-30
sigma HackTool - EDRSilencer Execution - Filter Added test 2024-01-30