Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN PolyglotDuke Domain Observed rev 2 2019-10-17
snort ET TROJAN PolyglotDuke Domain Observed rev 2 2019-10-17
snort ET TROJAN MiniDuke Domain Observed rev 2 2019-10-17
snort ET TROJAN PolyglotDuke Domain Observed rev 2 2019-10-17
snort ET MALWARE SoftwareTracking Site - Download Report rev 2 2019-10-17
snort ET TROJAN MiniDuke Domain Observed rev 2 2019-10-17
snort ET TROJAN PolyglotDuke Domain Observed rev 2 2019-10-17
snort ET TROJAN PolyglotDuke Domain Observed rev 2 2019-10-17
snort ET TROJAN FatDuke Domain Observed rev 2 2019-10-17
snort ET TROJAN LiteDuke Domain Observed rev 2 2019-10-17
snort ET TROJAN PolyglotDuke Domain Observed rev 2 2019-10-17
snort ET TROJAN PolyglotDuke Domain Observed rev 2 2019-10-17
snort ET TROJAN FatDuke Domain Observed rev 2 2019-10-17
snort ET TROJAN FatDuke Domain Observed rev 2 2019-10-17
snort ET TROJAN PolyglotDuke Domain Observed rev 2 2019-10-17
snort ET TROJAN PolyglotDuke Domain Observed rev 2 2019-10-17
snort ET USER_AGENTS Steam HTTP Client User-Agent rev 3 2019-10-16
snort ET TROJAN APT 41 LOWKEY Backdoor - Ping Error Code sent to CnC rev 2 2019-10-16
snort ET TROJAN APT 41 CnC Domain Observed in DNS Query rev 2 2019-10-16
snort ET TROJAN Possible APT 41 Fake Server Response rev 2 2019-10-16
snort ET TROJAN APT 41 LOWKEY Backdoor - Ping Success Code sent to CnC rev 2 2019-10-16
snort ET TROJAN APT 41 CnC Domain Observed in DNS Query rev 2 2019-10-16
snort ET TROJAN APT 41 CnC Domain Observed in DNS Query rev 2 2019-10-16
snort ET TROJAN APT 41 CnC Domain Observed in DNS Query rev 2 2019-10-16
suricata ET MALWARE APT 41 LOWKEY Backdoor - Ping Error Code sent to CnC rev 1 2019-10-16
suricata ET MALWARE APT 41 LOWKEY Backdoor - Ping Success Code sent to CnC rev 1 2019-10-16
snort ET TROJAN Redirect on ActiveXObject support rev 2 2019-10-15
suricata ET EXPLOIT_KIT Redirect on ActiveXObject support rev 2 2019-10-15
snort ET POLICY DNS Query to DynDNS Domain *.bounceme .net rev 2 2019-10-14
snort ET POLICY DNS Query to DynDNS Domain *.nflfan .org rev 2 2019-10-14
snort ET POLICY DNS Query to DynDNS Domain *.golffan .us rev 2 2019-10-14
snort ET POLICY DNS Query to DynDNS Domain *.brasilia .me rev 2 2019-10-14
snort ET POLICY DNS Query to DynDNS Domain *.homesecuritypc .com rev 2 2019-10-14
snort ET POLICY DNS Query to DynDNS Domain *.damnserver .com rev 2 2019-10-14
snort ET POLICY DNS Query to DynDNS Domain *.eating-organic .net rev 2 2019-10-14
snort ET POLICY DNS Query to DynDNS Domain *.read-books .org rev 2 2019-10-14
snort ET POLICY DNS Query to DynDNS Domain *.mypsx .net rev 2 2019-10-14
snort ET POLICY DNS Query to DynDNS Domain *.dnsiskinky .com rev 2 2019-10-14
snort ET POLICY DNS Query to DynDNS Domain *.serveexchange .com rev 2 2019-10-14
snort ET TROJAN NSO Group Pegasus CnC Domain Observed in DNS Query rev 2 2019-10-14