Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN GCleaner Downloader Activity M2 rev 2 2021-03-30
snort ET TROJAN GCleaner Downloader Activity M1 rev 2 2021-03-30
snort ET WEB_CLIENT Exchange Webshell CnC Domain in DNS Lookup rev 2 2021-03-29
snort ET MALWARE X-Files Stealer CnC Exfil Activity M1 rev 2 2021-03-26
suricata ET MALWARE X-Files Stealer CnC Exfil Activity M1 rev 2 2021-03-26
snort ET CURRENT_EVENTS ANTIBOT Phishing Panel Accessed on External Compromised Server rev 2 2021-03-25
snort ET CURRENT_EVENTS Generic Phishing Panel Accessed on Internal Server rev 2 2021-03-25
snort ET CURRENT_EVENTS Generic Phishing Panel Accessed on External Server rev 3 2021-03-25
snort ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2 rev 2 2021-03-25
snort ET CURRENT_EVENTS ANTIBOT Phishing Panel Accessed on Internal Compromised Server rev 2 2021-03-25
snort ET TROJAN Win32/FFDroider CnC Activity M2 rev 2 2021-03-25
snort ET CURRENT_EVENTS Generic Phishing Panel Accessed on External Server rev 2 2021-03-25
snort ET TROJAN Black KingDom Ransomware Related Activity rev 2 2021-03-25
snort ET TROJAN Konni Related Activity rev 2 2021-03-25
snort ET CURRENT_EVENTS Generic Phishing Panel Accessed on Internal Server rev 3 2021-03-25
snort ET TROJAN MSIL/TrojanDownloader.Small.CLJ CnC Activity rev 2 2021-03-25
suricata ET PHISHING ANTIBOT Phishing Panel Accessed on External Compromised Server rev 2 2021-03-25
suricata ET PHISHING Generic Phishing Panel Accessed on External Server rev 2 2021-03-25
suricata ET PHISHING Generic Phishing Panel Accessed on Internal Server rev 2 2021-03-25
suricata ET PHISHING ANTIBOT Phishing Panel Accessed on Internal Compromised Server rev 2 2021-03-25
suricata ET PHISHING Generic Phishing Panel Accessed on External Server rev 3 2021-03-25
suricata ET MALWARE Black KingDom Ransomware Related Activity rev 2 2021-03-25
suricata ET PHISHING Generic Phishing Panel Accessed on Internal Server rev 3 2021-03-25
suricata ET MALWARE Konni Related Activity rev 1 2021-03-25
snort ET MALWARE klm123.com Spyware User Agent rev 15 2021-03-23
snort ET TROJAN Cobalt Strike Beacon Activity rev 2 2021-03-22
snort ET TROJAN Kimsuky Maldoc Activity rev 2 2021-03-22
snort ET TROJAN Win32/MALWARECAT Exfil via SMTP rev 2 2021-03-22
suricata ET MALWARE Win32/MALWARECAT Exfil via SMTP rev 2 2021-03-22
snort ET TROJAN Netbounce Program Wrapper Download rev 2 2021-03-19
snort ET TROJAN Possible Ransomware HTTP POST to Onion Link Domain rev 2 2021-03-19
snort ET TROJAN Netbounce Proxy Activity rev 2 2021-03-19
suricata ET MALWARE Netbounce Proxy Activity rev 2 2021-03-19
suricata ET MALWARE Possible Ransomware HTTP POST to Onion Link Domain rev 1 2021-03-19
snort ET INFO PS1 Powershell File Request rev 2 2021-03-18
snort ET INFO PSM1 Powershell File Request rev 2 2021-03-18
snort ET INFO PSRC Powershell File Request rev 2 2021-03-18
snort ET INFO PS1XML Powershell File Request rev 2 2021-03-18
snort ET INFO Generic Powershell Launching Hidden Window rev 2 2021-03-18
snort ET INFO Generic Powershell Starting Wscript Process rev 2 2021-03-18