Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET INFO URL Observed in PDF Downloaded via Dropbox rev 2 2020-04-28
snort ET TROJAN BAZAR CnC Domain in DNS Lookup rev 2 2020-04-28
snort ET TROJAN MSIL/Firebird RAT CnC Checkin rev 3 2020-04-28
snort ET TROJAN DonotGroup CnC Domain in DNS Query rev 2 2020-04-28
snort ET TROJAN BAZAR CnC Domain in DNS Lookup rev 2 2020-04-28
snort ET TROJAN BAZAR CnC Domain in DNS Lookup rev 2 2020-04-28
snort ET TROJAN AntSword Webshell User-Agent Observed rev 2 2020-04-28
suricata ET MALWARE DonotGroup CnC Domain in DNS Query rev 2 2020-04-28
suricata ET WEB_SPECIFIC_APPS Symantec Endpoint Manager XXE RCE Attempt rev 4 2020-04-28
suricata ET EXPLOIT_KIT SWF filename used in IE 2014-0322 Watering Hole Attacks rev 4 2020-04-28
suricata ET JA3 Hash - Possible BAZAR Backdoor CnC rev 1 2020-04-28
snort ET TROJAN ASNAROK Related Domain in DNS Lookup rev 2 2020-04-27
snort ET TROJAN ASNAROK Related Domain in TLS SNI rev 2 2020-04-27
snort ET TROJAN ASNAROK Domain in TLS SNI rev 2 2020-04-27
snort ET TROJAN ASNAROK CnC Domain in DNS Lookup rev 2 2020-04-27
suricata ET MALWARE W32/DirCrypt.Ransomware CnC Checkin rev 4 2020-04-27
suricata ET INFO Possible Web Crawl using Wget rev 13 2020-04-27
suricata ET MOBILE_MALWARE Android/HeHe.Spy LoginRequest CnC Beacon rev 6 2020-04-27
suricata ET MALWARE W32/Downloader.Mevade.FBV CnC Beacon rev 4 2020-04-27
suricata ET MALWARE Limitless Logger RAT HTTP Activity rev 3 2020-04-27
suricata ET MALWARE W32/Asprox.ClickFraudBot CnC Beacon Acknowledgement rev 3 2020-04-27
suricata ET EXPLOIT Metasploit Plugin-Detect Posting Data 3 rev 5 2020-04-27
suricata ET MALWARE W32/Liftoh.Downloader Feed404 CnC Beacon rev 3 2020-04-27
suricata ET WEB_SPECIFIC_APPS WHMCS lt 5.2.8 SQL Injection rev 7 2020-04-27
suricata ET HUNTING Suspicious Jar name JavaUpdate.jar rev 4 2020-04-27
suricata ET MALWARE W32/Rshot.Backdoor File Upload CnC Beacon rev 3 2020-04-27
suricata ET MALWARE Worm.VBS.ayr Checkin 2 rev 6 2020-04-27
suricata ET MOBILE_MALWARE Android/HeHe.Spy GetTaskRequest CnC Beacon rev 4 2020-04-27
suricata ET EXPLOIT Metasploit Plugin-Detect Posting Data 1 rev 5 2020-04-27
suricata ET MALWARE Kishop.A checkin rev 3 2020-04-27
suricata ET MALWARE W32/Hesperus.Banker Tr-mail Variant Sending Data To CnC rev 4 2020-04-27
suricata ET MALWARE Hiloti/Mufanom Downloader Checkin rev 11 2020-04-27
suricata ET WEB_SERVER Possible Encrypted Webshell in POST rev 5 2020-04-27
suricata ET MALWARE Possible Mask C2 Traffic rev 3 2020-04-27
suricata ET MALWARE Blackbeard Check-in rev 3 2020-04-27
suricata ET MOBILE_MALWARE Android/HeHe.Spy ReportRequest CnC Beacon rev 7 2020-04-27
suricata ET MALWARE W32/Dadobra.Downloader/DNSChanger Dnsmake CnC Beacon rev 4 2020-04-27
suricata ET WEB_SERVER ATTACKER WebShell - PHP Offender - POST Command rev 3 2020-04-27
suricata ET EXPLOIT JavaX Toolkit Posting Plugin-Detect Data rev 5 2020-04-27
suricata ET MOBILE_MALWARE Android/HeHe.Spy RegisterRequest CnC Beacon rev 7 2020-04-27