Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE NSO Group Pegasus CnC Domain Observed in DNS Query rev 2 2020-10-19
suricata ET INFO POSSIBLE Web Crawl using Curl rev 11 2020-10-19
suricata ET MALWARE NSO Group Pegasus CnC Domain Observed in DNS Query rev 2 2020-10-19
suricata ET MALWARE APT 41 CnC Domain Observed in DNS Query rev 3 2020-10-19
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2020-10-19
suricata ET MALWARE JEUSD CnC Domain Observed in DNS Query rev 2 2020-10-19
suricata ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2020-10-19
suricata ET MALWARE NSO Group Pegasus CnC Domain Observed in DNS Query rev 2 2020-10-19
suricata ET MALWARE APT 41 CnC Domain Observed in DNS Query rev 3 2020-10-19
snort ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2020-10-14
snort ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2020-10-14
snort ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2020-10-14
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-10-14
snort ET TROJAN StormKitty Exfil via AnonFiles rev 2 2020-10-14
snort ET CURRENT_EVENTS Successful Chase Phish 2020-10-14 rev 2 2020-10-14
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-10-14
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-10-14
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-10-14
snort ET TROJAN Likely Malware CnC Hosted on 000webhostapp - POST to gate.php rev 2 2020-10-14
snort ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2020-10-14
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-10-14
snort ET CURRENT_EVENTS Possible Successful Generic Web.App Hosted Phish 2020-10-14 rev 2 2020-10-14
suricata ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2020-10-14
suricata ET MALWARE Likely Malware CnC Hosted on 000webhostapp - POST to gate.php rev 2 2020-10-14
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2020-10-14
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2020-10-14
suricata ET MALWARE WEBC2-TABLE Checkin 1 - APT1 Related rev 7 2020-10-14
suricata ET MALWARE WEBC2-TABLE Checkin 3 - APT1 Related rev 4 2020-10-14
suricata ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2020-10-14
suricata ET MALWARE WEBC2-TABLE Checkin 2 - APT1 Related rev 4 2020-10-14
snort ET TROJAN StormKitty Data Exfil via Telegram rev 2 2020-10-13
snort ET CURRENT_EVENTS Chase Phish Landing 2020-10-13 rev 2 2020-10-13
snort ET CURRENT_EVENTS Microsoft Account Login Hosted on Firebasestorage rev 2 2020-10-13
snort ET CURRENT_EVENTS Instagram Phishing Landing 2020-10-13 rev 2 2020-10-13
snort ET CURRENT_EVENTS Amazon Phishing Landing 2020-10-13 rev 2 2020-10-13
snort ET POLICY BSSID Location Lookup via api .mylnikov .org rev 2 2020-10-13
snort ET TROJAN PoetRAT CnC Domain in DNS Lookup rev 2 2020-10-13
suricata ET MALWARE CASHY200 CnC Domain in DNS Lookup rev 3 2020-10-13
suricata ET MALWARE StormKitty Data Exfil via Telegram rev 1 2020-10-13
suricata ET PHISHING Instagram Phishing Landing 2020-10-13 rev 2 2020-10-13