Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN TA402/Molerats Related Malware Domain in DNS Lookup rev 2 2021-12-27
snort ET TROJAN TA402/Molerats Related Malware Domain in DNS Lookup rev 1 2021-12-27
snort ET TROJAN TA402/Molerats CnC Checkin rev 2 2021-12-27
suricata ET MALWARE TA402/Molerats Related Malware Domain in DNS Lookup rev 1 2021-12-27
suricata ET MALWARE TA402/Molerats Related Malware Domain in DNS Lookup rev 2 2021-12-27
sigma Suspicious Connection to Remote Account test 2021-12-27
sigma Replace Desktop Wallpaper by Powershell test 2021-12-26
sigma Remove Account From Domain Admin Group test 2021-12-26
snort ET GAMES Moonlight Hack Domain in DNS Lookup rev 1 2021-12-23
snort ET POLICY Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M2 rev 3 2021-12-23
snort ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
snort ET POLICY Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M5 rev 3 2021-12-23
snort ET POLICY Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M4 rev 3 2021-12-23
snort ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
snort ET POLICY Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M3 rev 3 2021-12-23
snort ET GAMES Moonlight Hack Domain in DNS Lookup rev 1 2021-12-23
snort ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
snort ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
snort ET POLICY Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M1 rev 3 2021-12-23
snort ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
snort ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
snort ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
snort ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
suricata ET INFO Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
suricata ET INFO Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
suricata ET INFO Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M3 rev 3 2021-12-23
suricata ET INFO Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
suricata ET INFO Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M4 rev 3 2021-12-23
suricata ET INFO Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
suricata ET INFO Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
suricata ET INFO Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M5 rev 2 2021-12-23
suricata ET INFO Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M1 rev 2 2021-12-23
suricata ET INFO Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
suricata ET INFO Observed KnowBe4/Popcorn Training Simulated Phish Landing Page M2 rev 3 2021-12-23
suricata ET INFO Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
suricata ET INFO Observed DNS Query to KnowBe4 Simulated Phish Domain rev 3 2021-12-23
snort ET POLICY Serialized Java Object returned via LDAPv3 Response rev 2 2021-12-21
suricata ET INFO Serialized Java Object returned via LDAPv3 Response rev 2 2021-12-21
snort ET ATTACK_RESPONSE Possible CVE-2021-44228 Payload via LDAPv3 Response M2 rev 2 2021-12-20
snort ET POLICY JavaClass Returned Via Anonymous Outbound LDAPv3 Bind Request rev 2 2021-12-20