Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN TigerHunter DOTM CnC Checkin rev 1 2022-09-28
suricata ET MALWARE TigerHunter DOTM CnC Checkin rev 1 2022-09-28
sigma Unsigned Binary Loaded From Suspicious Location test 2022-09-28
sigma Potential Invoke-Mimikatz PowerShell Script test 2022-09-28
sigma Microsoft Defender Blocked from Loading Unsigned DLL test 2022-09-28
snort ET TROJAN Win32/SaintStealer CnC Response rev 1 2022-09-27
snort ET TROJAN Win32/Wacapew.C!ml CnC Checkin rev 1 2022-09-27
suricata ET MALWARE Win32/SaintStealer CnC Response rev 1 2022-09-27
suricata ET MALWARE Win32/Wacapew.C!ml CnC Checkin rev 1 2022-09-27
sigma Potential Remote Desktop Tunneling test 2022-09-27
sigma Wab Execution From Non Default Location test 2022-09-27
sigma UAC Bypass via Windows Firewall Snap-In Hijack test 2022-09-27
sigma UAC Bypass via ICMLuaUtil test 2022-09-27
sigma Wab/Wabmig Unusual Parent Or Child Processes test 2022-09-27
sigma Unusual File Modification by dns.exe test 2022-09-27
sigma Remote File Download Via Desktopimgdownldr Utility test 2022-09-27
sigma Potential Bumblebee Remote Thread Creation test 2022-09-27
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET TROJAN Maldoc CnC Checkin rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET CURRENT_EVENTS Successful Generic Credential Phish 2022-09-26 rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET TROJAN Golang/Webbfustator DNS Tunneling Activity rev 2 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET INFO DYNAMIC_DNS Query to dynnamn .ru Domain rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-09-26 rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET INFO DYNAMIC_DNS Query to didns .ru Domain rev 1 2022-09-26
snort ET TROJAN Win32/Logger RAT CnC Checkin rev 1 2022-09-26
snort ET TROJAN Gamaredon APT Backdoor Related Activity rev 1 2022-09-26
suricata ET PHISHING Successful Generic Credential Phish 2022-09-26 rev 1 2022-09-26
suricata ET MALWARE Win32/Logger RAT CnC Checkin rev 1 2022-09-26
suricata ET MALWARE Golang/Webbfustator DNS Tunneling Activity rev 2 2022-09-26
suricata ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response M2 rev 1 2022-09-26
sigma Use of W32tm as Timer test 2022-09-25