Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CURRENT_EVENTS Capesand EK Landing rev 2 2019-11-05
snort ET TROJAN Possible Darkhotel Higasia Downloader Requesting Module rev 2 2019-11-04
snort ET TROJAN Win32/Pterodo.NG Checkin 2 rev 4 2019-11-04
snort ET TROJAN MSIL.L4L Stealer IP Check rev 2 2019-10-31
snort ET TROJAN Unk/LNKR CnC Domain Observed in DNS Query rev 2 2019-10-31
snort ET TROJAN Kimsuky CnC Domain Observed in DNS Query rev 2 2019-10-31
snort ET TROJAN MSIL.L4L Stealer Screenshot Exfiltration rev 2 2019-10-31
snort ET TROJAN Unk/LNKR CnC Domain Observed in DNS Query rev 2 2019-10-31
snort ET TROJAN MSIL.L4L Stealer Systeminfo Exfiltration rev 2 2019-10-31
snort ET TROJAN Kimsuky CnC Domain Observed in DNS Query rev 2 2019-10-31
snort ET TROJAN StrongPity CnC Domain Observed in DNS Query rev 2 2019-10-31
suricata ET JA3 Hash - [Abuse.ch] Possible Dridex rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Trickbot rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Trickbot rev 2 2019-10-29
suricata ET JA3 Hash - Possible Malware - Trickbot rev 2 2019-10-29
suricata ET JA3 Hash - Possible Malware - Various Malspam/RigEK rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Adware rev 2 2019-10-29
suricata ET JA3 Hash - Possible Superfish rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Gozi rev 2 2019-10-29
suricata ET JA3 Hash - Possible Malware - Fake Firefox Font Update rev 2 2019-10-29
suricata ET JA3 Hash - Possible Malware - Various Malfams rev 2 2019-10-29
suricata ET JA3 Hash - Possible Malware - Neutrino rev 2 2019-10-29
suricata ET JA3 Hash - Possible Malware - Dridex rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Adware rev 2 2019-10-29
suricata ET JA3 Hash - Possible Malware - Neutrino rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Adware rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Troldesh Ransomware rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Dridex rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Adware rev 2 2019-10-29
suricata ET JA3 Hash - Possible Malware - Malspam rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Adware rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Adware rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Dridex rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Gootkit rev 2 2019-10-29
suricata ET JA3 Hash - Possible Malware - Dridex rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Trickbot rev 2 2019-10-29
suricata ET JA3 Hash - [Abuse.ch] Possible Adware rev 2 2019-10-29
suricata ET JA3 Hash - Possible Malware - Boleto Malspam rev 2 2019-10-29
suricata ET JA3 Hash - mitmproxy rev 2 2019-10-29
suricata ET JA3 Hash - Possible Malware - RigEK rev 2 2019-10-29