Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET INFO DYNAMIC_DNS Query to a *.mylftv .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.moneyhome .biz Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.serveusers .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.isasecret .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.ftpserver .biz Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.dsmtp .biz Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.ninth .biz Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.onmypc .biz Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.xxxy .biz Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.serveuser .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.wwwhost .us Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.onedumb .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.xxxy .biz Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.changeip .us Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.mynetav .net Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.2waky .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.zyns .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.toythieves .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.cleansite .biz Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.dns-report .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.dhcp .biz Domain rev 2 2022-04-14
suricata ET MALWARE Lyceum Golang HTTP Backdoor Submitting Data to CnC rev 1 2022-04-14
suricata ET MALWARE Fodcha Bot CnC Heartbeat Response rev 2 2022-04-14
suricata ET MALWARE Lyceum Golang HTTP Backdoor Requesting Commands rev 1 2022-04-14
suricata ET MALWARE Fodcha Bot CnC Client Heartbeat rev 2 2022-04-14
suricata ET MALWARE Lyceum Golang HTTP Backdoor CnC Checkin rev 1 2022-04-14
sigma Arbitrary Shell Command Execution Via Settingcontent-Ms test 2022-04-14
snort ET CURRENT_EVENTS Sparkasse Credential Phish Landing Page M1 2022-04-13 rev 1 2022-04-13
snort ET TROJAN VBS/Agent.PUK Data Exfiltration Request M1 rev 1 2022-04-13
snort ET ATTACK_RESPONSE FTP CWD to windows system32 - Suspicious rev 8 2022-04-13
snort ET MOBILE_MALWARE Observed Trojan-Spy.AndroidOS.Agent.abe Domain in TLS SNI rev 2 2022-04-13
snort ET CURRENT_EVENTS Sparkasse Credential Phish Landing Page M4 2022-04-13 rev 1 2022-04-13
snort ET CURRENT_EVENTS Successful Sparkasse Credential Phish M2 2022-04-13 rev 1 2022-04-13
snort ET CURRENT_EVENTS Successful Sparkasse Credential Phish M1 2022-04-13 rev 1 2022-04-13
snort ET POLICY SMB NT Create AndX Request For an Executable File In a Temp Directory rev 3 2022-04-13
snort ET TROJAN VBS/Agent.PUK Data Exfiltration Request M2 rev 1 2022-04-13
suricata ET HUNTING FTP CWD to windows system32 - Suspicious rev 7 2022-04-13
suricata ET INFO SMB NT Create AndX Request For an Executable File In a Temp Directory rev 3 2022-04-13
suricata ET MALWARE VBS/Agent.PUK Data Exfiltration Request M2 rev 1 2022-04-13
suricata ET PHISHING Sparkasse Credential Phish Landing Page M4 2022-04-13 rev 2 2022-04-13