Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Possible STEADYPULSE Webshell Accessed M2 rev 2 2021-04-21
snort ET TROJAN Likely Evil Request for uac.exe With Minimal Headers rev 2 2021-04-21
snort ET INFO Observed DNS Query to DDNS Domain .myfirewall .org rev 1 2021-04-21
suricata ET INFO Observed DNS Query to DDNS Domain .myfirewall .org rev 1 2021-04-21
suricata ET MALWARE 44 Caliber Stealer Data Exfil via Discord rev 1 2021-04-21
snort ET TROJAN HabitsRAT Checkin rev 2 2021-04-20
snort ET TROJAN Cobalt Strike Stager Time Check M2 rev 1 2021-04-20
snort ET TROJAN Possibly SLIGHTPULSE Related - Suspicious POST to Specific URI Path rev 2 2021-04-20
snort ET TROJAN Cobalt Strike Stager Time Check M1 rev 2 2021-04-20
snort ET TROJAN Magecart/Skimmer - _try_action Exfil Attempt rev 2 2021-04-20
suricata ET MALWARE Possibly SLIGHTPULSE Related - Suspicious POST to Specific URI Path rev 1 2021-04-20
suricata ET MALWARE Magecart/Skimmer - _try_action Exfil Attempt rev 1 2021-04-20
suricata ET MALWARE Cobalt Strike Stager Time Check M2 rev 1 2021-04-20
suricata ET MALWARE Cobalt Strike Stager Time Check M1 rev 2 2021-04-20
snort ET TROJAN Win32/Unk Downloader CnC Activity rev 3 2021-04-19
snort ET TROJAN Remcos Builder License Check rev 2 2021-04-19
snort ET TROJAN Gamaredon MalDoc CnC Exfil rev 2 2021-04-19
snort ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation - Responding with Superuser Credentials rev 2 2021-04-19
snort ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation Inbound M1 rev 2 2021-04-19
snort ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation Inbound M2 rev 2 2021-04-19
suricata ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation Inbound M2 rev 1 2021-04-19
suricata ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation Inbound M1 rev 1 2021-04-19
snort ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2021-04-16
snort ET TROJAN Remcos 3.x Unencrypted Server Response rev 2 2021-04-16
snort ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2021-04-16
snort ET TROJAN Remcos 3.x Unencrypted Checkin rev 2 2021-04-16
suricata ET MALWARE Remcos 3.x Unencrypted Server Response rev 2 2021-04-16
suricata ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2021-04-16
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2021-04-16
suricata ET MALWARE Remcos 3.x Unencrypted Checkin rev 2 2021-04-16
elastic PowerShell spawning Cmd deprecated 2021-04-15
elastic Proxy Port Activity to the Internet deprecated 2021-04-15
elastic TCP Port 8000 Activity to the Internet deprecated 2021-04-15
elastic User Discovery via Whoami deprecated 2021-04-15
elastic Network Sniffing via Tcpdump deprecated 2021-04-15
elastic SSH (Secure Shell) to the Internet deprecated 2021-04-15
elastic SSH (Secure Shell) from the Internet deprecated 2021-04-15
elastic Trusted Developer Application Usage deprecated 2021-04-15
elastic PPTP (Point to Point Tunneling Protocol) Activity deprecated 2021-04-15
elastic Query Registry via reg.exe deprecated 2021-04-15