Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Valyria Downloader Activity rev 1 2021-06-30
suricata ET MALWARE Reborn Stealer 2021 Exfil attempt via Telegram rev 1 2021-06-30
sigma AWS SecurityHub Findings Evasion stable 2021-06-28
sigma CMSTP Execution Process Access stable 2021-06-27
snort ET TROJAN GCleaner Related Downloader User-Agent rev 1 2021-06-25
snort ET CURRENT_EVENTS Observed Possible Phishing Landing Page 2021-06-24 rev 1 2021-06-25
suricata ET PHISHING Observed Possible Phishing Landing Page 2021-06-24 rev 1 2021-06-25
snort ET TROJAN lu0bot Loader HTTP Response rev 1 2021-06-24
snort ET TROJAN lu0bot Loader HTTP Request rev 1 2021-06-24
snort ET MALWARE AllaKore CnC Activity rev 2 2021-06-24
snort ET TROJAN lu0bot CnC Domain in DNS Lookup rev 2 2021-06-24
snort ET TROJAN lu0bot CnC Domain in DNS Lookup rev 2 2021-06-24
snort ET TROJAN lu0bot CnC Domain in DNS Lookup rev 2 2021-06-24
snort ET TROJAN lu0bot CnC Domain in DNS Lookup rev 2 2021-06-24
suricata ET MALWARE lu0bot Loader HTTP Response rev 1 2021-06-24
suricata ET MALWARE AllaKore CnC Activity rev 2 2021-06-24
snort ET POLICY Ask Webcrawler User-Agent rev 1 2021-06-23
snort ET TROJAN Win32/Vidar Variant/Mars Stealer CnC Exfil rev 1 2021-06-23
snort ET SCAN Exabot Webcrawler User Agent rev 2 2021-06-23
snort ET SCAN AOL Webcrawler User-Agent rev 2 2021-06-23
snort ET TROJAN Maldoc Downloading from Dropbox via API rev 1 2021-06-23
snort ET TROJAN Linux DarkRadiation Ransomware Activity Attack Check rev 2 2021-06-23
snort ET CURRENT_EVENTS Observed Possible Phishing Landing Page 2021-06-22 rev 1 2021-06-22
suricata ET JA3 Hash - Possible Cobalt Strike Server rev 1 2021-06-22
suricata ET PHISHING Observed Possible Phishing Landing Page 2021-06-22 rev 1 2021-06-22
sigma Password Dumper Remote Thread in LSASS stable 2021-06-21
suricata ET JA3 Hash - Possible Nessus Client rev 1 2021-06-17
snort ET TROJAN APT28/SkinnyBoy Checkin rev 2 2021-06-11
snort ET INFO Observed DNS Query to DDNS Domain .otzo .com rev 2 2021-06-09
snort ET TROJAN Observed DNS Query to Known Gelsemium CnC rev 2 2021-06-09
snort ET TROJAN Observed DNS Query to Known Gelsemium CnC rev 2 2021-06-09
snort ET TROJAN Observed DNS Query to Known Gelsemium CnC rev 2 2021-06-09
snort ET INFO Observed DNS Query to DDNS Domain .zzux .com rev 2 2021-06-09
snort ET INFO Observed DNS Query to DDNS Domain .dns1 .us rev 2 2021-06-09
snort ET TROJAN Observed DNS Query to Known Gelsemium CnC rev 2 2021-06-09
snort ET INFO Observed DNS Query to DDNS Domain .zyns .com rev 2 2021-06-09
suricata ET MALWARE Observed DNS Query to Known Gelsemium CnC rev 1 2021-06-09
suricata ET MALWARE Observed DNS Query to Known Gelsemium CnC rev 1 2021-06-09
suricata ET INFO Observed DNS Query to DDNS Domain .zyns .com rev 1 2021-06-09
suricata ET MALWARE Observed DNS Query to Known Gelsemium CnC rev 1 2021-06-09