Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 15 rev 4 2020-09-16
suricata ET MOBILE_MALWARE NSO Related Domain 1 rev 4 2020-09-16
suricata ET INFO DNS Query for Suspicious .gq Domain rev 4 2020-09-16
suricata ET INFO HTTP POST Request to Suspicious *.ml Domain rev 3 2020-09-16
suricata ET MALWARE APT DarkHydrus DNS Lookup 19 rev 3 2020-09-16
suricata ET MALWARE BrushaLoader CnC DNS Lookup rev 3 2020-09-16
suricata ET MALWARE BrushaLoader CnC DNS Lookup rev 3 2020-09-16
suricata ET MALWARE BrushaLoader CnC DNS Lookup rev 3 2020-09-16
suricata ET MALWARE APT DarkHydrus DNS Lookup 14 rev 3 2020-09-16
suricata ET MALWARE APT DarkHydrus DNS Lookup 28 rev 3 2020-09-16
suricata ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 12 rev 4 2020-09-16
suricata ET MALWARE PS/PowerRatankba CnC DNS Lookup rev 4 2020-09-16
suricata ET MALWARE STOLENPENCIL CnC Domain in DNS Lookup rev 4 2020-09-16
suricata ET MALWARE TEMP.Periscope APT Domain in DNS Lookup rev 4 2020-09-16
suricata ET MALWARE TEMP.Periscope APT Domain in DNS Lookup rev 4 2020-09-16
suricata ET MOBILE_MALWARE NSO Related Domain 8 rev 4 2020-09-16
suricata ET MALWARE BrushaLoader CnC DNS Lookup rev 3 2020-09-16
suricata ET MOBILE_MALWARE NSO Related Domain 16 rev 4 2020-09-16
suricata ET MALWARE APT DarkHydrus DNS Lookup 20 rev 3 2020-09-16
suricata ET MALWARE BrushaLoader CnC DNS Lookup rev 3 2020-09-16
suricata ET MALWARE APT DarkHydrus DNS Lookup 17 rev 3 2020-09-16
suricata ET MOBILE_MALWARE NSO Related Domain 32 rev 4 2020-09-16
suricata ET MOBILE_MALWARE NSO Related Domain 38 rev 4 2020-09-16
suricata ET MALWARE STOLENPENCIL CnC Domain in DNS Lookup rev 4 2020-09-16
suricata ET MALWARE STOLENPENCIL CnC Domain in DNS Lookup rev 4 2020-09-16
suricata ET MALWARE BrushaLoader CnC DNS Lookup rev 3 2020-09-16
suricata ET MOBILE_MALWARE NSO Related Domain 39 rev 4 2020-09-16
suricata ET MALWARE STOLENPENCIL CnC Domain in DNS Lookup rev 4 2020-09-16
suricata ET MALWARE STOLENPENCIL CnC Domain in DNS Lookup rev 4 2020-09-16
suricata ET MALWARE APT33/CharmingKitten DDNS Overlap Domain in DNS Lookup M2 rev 5 2020-09-16
suricata ET MALWARE JS.InfectedMikrotik Injects Domain Observed in TLS SNI rev 4 2020-09-16
suricata ET INFO HTTP POST Request to Suspicious *.ga Domain rev 3 2020-09-16
suricata ET MOBILE_MALWARE NSO Related Domain 35 rev 4 2020-09-16
suricata ET MOBILE_MALWARE NSO Related Domain 2 rev 4 2020-09-16
suricata ET MALWARE BrushaLoader CnC DNS Lookup rev 3 2020-09-16
suricata ET MALWARE STOLENPENCIL CnC Domain in DNS Lookup rev 4 2020-09-16
suricata ET MOBILE_MALWARE NSO Related Domain 3 rev 4 2020-09-16
suricata ET MOBILE_MALWARE iOS/Bahamut DNS Lookup 9 rev 4 2020-09-16
suricata ET INFO HTTP POST Request to Suspicious *.gdn Domain rev 4 2020-09-16
suricata ET MALWARE APT DarkHydrus DNS Lookup 15 rev 3 2020-09-16