Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET INFO HTTP Request to a *.buzz domain rev 1 2021-05-18
suricata ET INFO HTTP Request to a *.surf domain rev 1 2021-05-18
snort ET TROJAN VenusLocker Associated User-Agent Activity rev 1 2021-05-17
snort ET TROJAN Remote Desktop Spy Install Checkin rev 2 2021-05-14
sigma DarkSide Ransomware Pattern test 2021-05-14
suricata ET JA3 Hash - Possible RustyBuer Server Response rev 1 2021-05-13
snort ET POLICY PCHunter CnC activity rev 1 2021-05-12
suricata ET INFO PCHunter CnC activity rev 1 2021-05-12
suricata ET INFO Possible Overflow Attempt - Abnormally Large SMTP EHLO Inbound rev 2 2021-05-11
suricata ET MALWARE zgRAT / PureLogs CnC Activity rev 2 2021-05-10
snort ET MALWARE lolzilla JS/PHP WebSkimmer - Data Exfil rev 1 2021-05-10
snort ET TROJAN Pingback Exep Command Issued rev 1 2021-05-10
snort ET TROJAN Pingback Download Command Issued rev 2 2021-05-10
snort ET INFO Suspicious GET Request for .x86 rev 1 2021-05-10
snort ET TROJAN Pingback Shell Command Issued rev 2 2021-05-10
snort ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M4 rev 1 2021-05-10
snort ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M5 rev 1 2021-05-10
snort ET TROJAN Pingback Exec Command Issued rev 2 2021-05-10
snort ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M1 rev 2 2021-05-10
snort ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M3 rev 2 2021-05-10
snort ET TROJAN Pingback Upload Command Issued rev 2 2021-05-10
snort ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M2 rev 2 2021-05-10
snort ET INFO Suspicious GET Request for .x64 rev 1 2021-05-10
suricata ET MALWARE Pingback Exep Command Issued rev 1 2021-05-10
suricata ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M4 rev 1 2021-05-10
suricata ET MALWARE Pingback Upload Command Issued rev 2 2021-05-10
suricata ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M3 rev 1 2021-05-10
suricata ET MALWARE Pingback Shell Command Issued rev 2 2021-05-10
suricata ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M1 rev 1 2021-05-10
suricata ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M2 rev 1 2021-05-10
suricata ET MALWARE Pingback Download Command Issued rev 2 2021-05-10
suricata ET MALWARE lolzilla JS/PHP WebSkimmer - Data Exfil rev 1 2021-05-10
suricata ET MALWARE Pingback Exec Command Issued rev 2 2021-05-10
suricata ET WEB_SERVER lolzilla WebSkimmer - Remote Code Execution Attempt M5 rev 1 2021-05-10
snort ET TROJAN Kimsuky APT CnC Domain in DNS Lookup rev 1 2021-05-06
snort ET TROJAN Kimsuky APT CnC Domain in DNS Lookup rev 1 2021-05-06
snort ET MALWARE SuperAntiSpyware Install Checkin rev 2 2021-05-06
snort ET TROJAN Kimsuky APT CnC Domain in DNS Lookup rev 1 2021-05-06
snort ET NETBIOS DCERPC DCOM ExecuteShellCommand Call - Likely Lateral Movement rev 2 2021-05-06
suricata ET NETBIOS DCERPC DCOM ExecuteShellCommand Call - Likely Lateral Movement rev 2 2021-05-06