Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE SUNSHUTTLE CnC Activity rev 1 2021-03-04
suricata ET EXPLOIT ARG-W4 ASDL Router DNS Changer Exploit Attempt rev 4 2021-03-04
suricata ET EXPLOIT D-Link DI-804HV DNS Changer Exploit Attempt rev 1 2021-03-04
suricata ET WEB_CLIENT APT/Hafnium SPORTSBALL Webshell Observed Outbound rev 2 2021-03-04
snort ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI rev 2 2021-03-03
snort ET EXPLOIT COMTREND ADSL Router CT-5367 Remote DNS Change Attempt rev 2 2021-03-03
snort ET INFO Hidden embedded HTML Document rev 2 2021-03-03
suricata ET EXPLOIT COMTREND ADSL Router CT-5367 Remote DNS Change Attempt rev 4 2021-03-03
suricata ET HUNTING Hidden embedded HTML Document rev 1 2021-03-03
snort ET TROJAN W32/Echmark CnC Activity M2 rev 2 2021-03-02
suricata ET MALWARE W32/Echmark CnC Activity M2 rev 1 2021-03-02
snort ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server rev 2 2021-03-01
snort ET WEB_SERVER Generic Uploader Accessed on Internal Compromised Server rev 2 2021-03-01
snort ET TROJAN Suspected APT32/OceanLotus Activity rev 2 2021-03-01
snort ET WEB_CLIENT Generic Uploader Accessed on External Compromised Server rev 2 2021-03-01
snort ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server rev 2 2021-03-01
suricata ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server rev 2 2021-03-01
suricata ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server rev 2 2021-03-01
suricata ET WEB_SERVER Generic Uploader Accessed on Internal Compromised Server rev 2 2021-03-01
suricata ET WEB_CLIENT Generic Uploader Accessed on External Compromised Server rev 2 2021-03-01
snort ET EXPLOIT Inbound Hashicorp Consul RCE via Services API rev 2 2021-02-26
suricata ET EXPLOIT Inbound Hashicorp Consul RCE via Services API rev 1 2021-02-26
snort ET TROJAN BazaBackdoor Variant CnC Activity M4 rev 2 2021-02-25
snort ET TROJAN MINEBRIDGE CnC Activity rev 2 2021-02-24
snort ET TROJAN MINEBRIDGE CnC Activity rev 2 2021-02-24
snort ET TROJAN MINEBRIDGE CnC Activity rev 2 2021-02-24
snort ET WEB_SERVER DEWMODE Webshell Observed Outbound rev 2 2021-02-23
snort ET WEB_SERVER Generic Webshell Observed Outbound rev 2 2021-02-23
snort ET TROJAN VoidRay Downloader CnC Activity rev 2 2021-02-23
snort ET TROJAN MSIL/Spy.Keylogger.ENJ Variant CnC Activity rev 2 2021-02-23
suricata ET WEB_SERVER Generic Webshell Observed Outbound rev 1 2021-02-23
suricata ET WEB_SERVER DEWMODE Webshell Observed Outbound rev 1 2021-02-23
snort ET INFO Suspicious Use of rzd URL Shortener Service rev 2 2021-02-22
snort ET TROJAN Observed OSX/Silver Sparrow Download Domain in TLS SNI rev 2 2021-02-22
snort ET TROJAN Observed OSX/Silver Sparrow Download Domain in TLS SNI rev 2 2021-02-22
snort ET TROJAN Win32/LODEINFO v0.4.x CnC Checkin rev 2 2021-02-19
snort ET TROJAN OSX/NukeSped Variant CnC Activity rev 2 2021-02-19
suricata ET MALWARE OSX/NukeSped Variant CnC Activity rev 1 2021-02-19
suricata ET MALWARE AppleJeus - Kupay Wallet CnC Activity rev 2 2021-02-19
snort ET TROJAN AppleJeus - Union Crypto CnC Activity rev 2 2021-02-18