Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma HackTool - EDRSilencer Execution - Filter Added test 2024-01-30
snort ET DNS DNS Query for a Suspicious *.co.tv domain rev 4 2024-01-29
snort ET INFO DYNAMIC_DNS Query to 3322.net Domain *.8800.org rev 7 2024-01-29
snort ET INFO DYNAMIC_DNS Query to 3322.org Domain rev 8 2024-01-29
snort ET EXPLOIT Netis E1+ 1.2.32533 - Unauthenticated WiFi Password Leak rev 3 2024-01-29
snort ET DNS Query for a Suspicious *.noc.su domain rev 4 2024-01-29
snort ET INFO DYNAMIC_DNS Query to 3322.net Domain *.8866.org rev 8 2024-01-29
snort ET TROJAN Cryptowall .onion Proxy Domain rev 3 2024-01-29
snort ET TROJAN NBP Mac PUP User-Agent Observed rev 1 2024-01-29
snort ET DNS DNS Query for a Suspicious *.cu.cc domain rev 4 2024-01-29
snort ET POLICY DNS Query For XXX Adult Site Top Level Domain rev 3 2024-01-29
snort ET INFO DNS Query Domain .bit rev 4 2024-01-29
snort ET DNS DNS Query for Suspicious .cz.cc Domain rev 5 2024-01-29
suricata ET ADWARE_PUP NBP Mac PUP User-Agent Observed rev 1 2024-01-29
sigma HackTool - SharpMove Tool Execution test 2024-01-29
snort ET WEB_SERVER Fake Googlebot UA 2 Inbound rev 5 2024-01-27
suricata ET WEB_SERVER Fake Googlebot UA 2 Inbound rev 4 2024-01-27
snort ET WEB_SPECIFIC_APPS Mailtrail v0.53 Command Injection Attempt rev 2 2024-01-26
suricata ET WEB_SPECIFIC_APPS Mailtrail v0.53 Command Injection Attempt rev 2 2024-01-26
sigma Potential Pikabot C2 Activity test 2024-01-26
sigma Pikabot Fake DLL Extension Execution Via Rundll32.EXE test 2024-01-26
sigma Potential Pikabot Hollowing Activity test 2024-01-26
sigma Potential Pikabot Discovery Activity test 2024-01-26
sigma Uncommon Connection to Active Directory Web Services test 2024-01-26
sigma HackTool - SOAPHound Execution test 2024-01-26
sigma CobaltStrike Named Pipe Patterns test 2024-01-26
snort ET INFO Suspicious Google Docs Page - Possible Phishing Landing rev 3 2024-01-25
snort ET INFO Generic - Mozilla 4.0 EXE Request rev 5 2024-01-25
snort ET CURRENT_EVENTS Spelevo EK Post-Compromise Data Dump rev 3 2024-01-25
snort ET TROJAN MS_D0wnl0ad3r Screenshot Upload rev 3 2024-01-25
snort ET TROJAN MS_D0wnl0ad3r Checkin rev 2 2024-01-25
snort ET TROJAN nspx30 Orchestrator CnC Checkin rev 1 2024-01-25
snort ET TROJAN MSIL/Unk.CoinMiner Downloader rev 3 2024-01-25
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES Server] rev 3 2024-01-25
snort ET EXPLOIT Unk.IoT IPCamera Exploit Attempt Inbound rev 4 2024-01-25
snort ET TROJAN nspx30 Backdoor Trigger Response Observed rev 1 2024-01-25
suricata ET PHISHING Suspicious Google Docs Page - Possible Phishing Landing rev 5 2024-01-25
suricata ET MALWARE nspx30 Backdoor Trigger Response Observed rev 1 2024-01-25
suricata ET MALWARE nspx30 Orchestrator CnC Checkin rev 1 2024-01-25
sigma PowerShell ShellCode test 2024-01-25