Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Win32/Wacatac.B Payload Download rev 2 2022-05-11
suricata ET MALWARE Win32/Wacatac.B Payload Download rev 2 2022-05-11
snort ET TROJAN Win32/SilentBreak Related Domain in DNS Lookup rev 2 2022-05-10
snort ET TROJAN Win32/Wacatac.B Loader CnC Checkin rev 2 2022-05-09
suricata ET MALWARE Win32/Wacatac.B Loader CnC Checkin rev 2 2022-05-09
elastic Linux Restricted Shell Breakout via crash Shell evasion deprecated 2022-05-09
elastic Linux Restricted Shell Breakout via the gcc command deprecated 2022-05-09
elastic Linux Restricted Shell Breakout via the mysql command deprecated 2022-05-09
elastic Linux Restricted Shell Breakout via env Shell Evasion deprecated 2022-05-09
elastic Linux Restricted Shell Breakout via the SSH command deprecated 2022-05-09
elastic Linux Restricted Shell Breakout via cpulimit Shell Evasion deprecated 2022-05-09
elastic Linux Restricted Shell Breakout via the vi command deprecated 2022-05-09
elastic Linux Restricted Shell Breakout via flock Shell evasion deprecated 2022-05-09
elastic Linux Restricted Shell Breakout via the find command deprecated 2022-05-09
elastic Linux Restricted Shell Breakout via apt/apt-get Changelog Escape deprecated 2022-05-09
elastic Linux Restricted Shell Breakout via awk Commands deprecated 2022-05-09
elastic Linux Restricted Shell Breakout via the expect command deprecated 2022-05-09
elastic Linux Restricted Shell Breakout via busybox Shell Evasion deprecated 2022-05-09
elastic Linux Restricted Shell Breakout via c89/c99 Shell evasion deprecated 2022-05-09
sigma Password Protected ZIP File Opened (Email Attachment) test 2022-05-09
sigma Password Protected ZIP File Opened test 2022-05-09
sigma Password Protected ZIP File Opened (Suspicious Filenames) test 2022-05-09
snort ET TROJAN PoshC2 - Observed Default URI Structure M31 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M7 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M25 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M9 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M27 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M13 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M19 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M11 rev 2 2022-05-06
snort ET TROJAN PhantomNet/Smanager Related Domain in DNS Lookup rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M17 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M26 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M8 rev 2 2022-05-06
snort ET INFO Trend Micro Phishing Simulation Service rev 2 2022-05-06
snort ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Origami.b / Donot DNS Lookup rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M29 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M10 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M28 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M24 rev 2 2022-05-06