Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET INFO DNS Query for TOR Hidden Domain .onion Accessible Via TOR rev 5 2020-09-17
suricata ET PHISHING Successful Phish Gmail Recovery Information 2015-10-01 rev 5 2020-09-17
suricata ET MALWARE Magecart CnC Domain Observed in DNS Query rev 3 2020-09-17
suricata ET MALWARE APT33 CnC Domain in DNS Lookup rev 3 2020-09-17
suricata ET MALWARE DonotGroup Stage 2 CnC Domain in DNS Lookup rev 3 2020-09-17
suricata ET MALWARE Win32/Varenyky Spambot CnC in DNS Query rev 3 2020-09-17
suricata ET MALWARE APT33 CnC Domain in DNS Lookup rev 3 2020-09-17
suricata ET MALWARE Glupteba CnC Observed in DNS Query rev 3 2020-09-17
suricata ET INFO Query for Suspicious .ch.tf Domain rev 5 2020-09-17
suricata ET MALWARE FIN8 ShellTea CnC in DNS Lookup rev 3 2020-09-17
suricata ET MALWARE APT28 CnC Domain DNS Lookup rev 3 2020-09-17
suricata ET MALWARE LYCEUM CnC Domain Observed in DNS Query rev 3 2020-09-17
suricata ET PHISHING Possible Protonmail Phishing Domain in DNS Query rev 4 2020-09-17
suricata ET MALWARE ShadowHammer DNS Lookup rev 3 2020-09-17
suricata ET MALWARE DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns rev 4 2020-09-17
suricata ET PHISHING Possible Protonmail Phishing Domain in DNS Query rev 4 2020-09-17
suricata ET MALWARE Win32/Varenyky Spambot CnC in DNS Query rev 3 2020-09-17
suricata ET INFO Query for Suspicious .edu.tf Domain rev 5 2020-09-17
suricata ET INFO Internal Host Retrieving External IP Via myip.ozymo.com rev 4 2020-09-17
suricata ET MALWARE FIN8 ShellTea CnC in DNS Query rev 3 2020-09-17
suricata ET MALWARE ServHelper CnC Domain rev 3 2020-09-17
suricata ET MALWARE APT33 CnC Domain in DNS Lookup rev 3 2020-09-17
suricata ET PHISHING Possible Protonmail Phishing Domain in DNS Query rev 4 2020-09-17
suricata ET MALWARE APT33 CnC Domain in DNS Lookup rev 3 2020-09-17
suricata ET MALWARE DarkHotel CnC Domain in DNS Lookup rev 3 2020-09-17
suricata ET MALWARE LYCEUM CnC Domain Observed in DNS Query rev 3 2020-09-17
suricata ET MALWARE LYCEUM CnC Domain Observed in DNS Query rev 3 2020-09-17
suricata ET MALWARE Possible ShadowHammer DNS Lookup rev 4 2020-09-17
suricata ET INFO DNS Query for Suspicious .ch.vu Domain rev 8 2020-09-17
suricata ET MALWARE Win32/Unk HeavensGate Loader CnC in DNS Lookup rev 3 2020-09-17
suricata ET INFO DNS Query to a Suspicious *.vv.cc domain rev 5 2020-09-17
suricata ET MALWARE APT33 CnC Domain in DNS Lookup rev 3 2020-09-17
suricata ET MALWARE DNSChanger CnC Domain in DNS Lookup rev 3 2020-09-17
suricata ET MALWARE DarkHotel CnC Domain in DNS Lookup rev 3 2020-09-17
suricata ET MALWARE FIN8 ShellTea CnC in DNS Query rev 3 2020-09-17
suricata ET MALWARE APT33 CnC Domain in DNS Lookup rev 3 2020-09-17
suricata ET MALWARE APT33 CnC Domain in DNS Lookup rev 3 2020-09-17
suricata ET MALWARE APT33 CnC Domain in DNS Lookup rev 3 2020-09-17
suricata ET MALWARE VirTool.Win32/VBInject.gen!DM Checkin rev 9 2020-09-17
suricata ET MALWARE Gift Cardshark CnC Domain in DNS Lookup rev 3 2020-09-17