Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Glupteba CnC Domain in DNS Lookup rev 2 2019-09-05
snort ET TROJAN Glupteba CnC Domain in DNS Lookup rev 2 2019-09-05
snort ET INFO McAfee AV Download - Set rev 2 2019-09-05
snort ET INFO Cloudflare DNS Over HTTPS Certificate Inbound rev 3 2019-09-05
snort ET TROJAN Win32/Laturo Stealer CnC Checkin rev 2 2019-09-04
snort ET TROJAN W32/Pterodo CnC Checkin rev 2 2019-09-04
snort ET MOBILE_MALWARE Android/Locker.B Checkin 1 rev 2 2019-09-03
snort ET CURRENT_EVENTS Successful National Australia Bank Phish 2016-12-02 rev 2 2019-09-03
snort ET POLICY DNS Query to a Reverse Proxy Service Observed rev 2 2019-09-03
snort ET POLICY DNS Query to a Reverse Proxy Service Observed rev 2 2019-09-03
snort ET MOBILE_MALWARE Android/Locker.B Checkin 2 rev 2 2019-09-03
snort ET CURRENT_EVENTS Successful FR Carte Bleue / BCP Phish 2016-09-06 rev 2 2019-09-03
snort ET CURRENT_EVENTS Successful Mailbox Update Phish 2016-02-17 rev 2 2019-09-03
snort ET TROJAN Nitlove POS CnC rev 2 2019-09-03
snort ET POLICY DNS Query to a Reverse Proxy Service Observed rev 2 2019-09-03
suricata ET DNS DNS Lookup for localhost.DOMAIN.TLD rev 6 2019-09-03
snort ET TROJAN Possible APT28 Maldoc CnC Checkin rev 2 2019-09-02
snort ET WEB_SERVER WebShell Generic - *.tar.gz in POST body rev 2 2019-08-30
snort ET MOBILE_MALWARE Apple iPhone Implant - Upload Files rev 2 2019-08-30
snort ET TROJAN Domen SocEng CnC Observed in DNS Query rev 2 2019-08-30
snort ET CURRENT_EVENTS Domen SocEng Redirect - Landing Page Observed rev 2 2019-08-30
snort ET MOBILE_MALWARE Apple iPhone Implant - Boundary Observed rev 2 2019-08-30
snort ET MOBILE_MALWARE Apple iPhone Implant - Command Executed rev 2 2019-08-30
snort ET CURRENT_EVENTS RIG EK - Unexpected Victim Location Server Response rev 2 2019-08-30
snort ET TROJAN Domen SocEng CnC Observed in DNS Query rev 2 2019-08-30
snort ET TROJAN Domen SocEng CnC Observed in DNS Query rev 2 2019-08-30
snort ET CURRENT_EVENTS Successful Facebook Phish 2019-08-29 rev 2 2019-08-29
snort ET TROJAN CDT Credphish/Netwire Campaign DNS Lookup rev 2 2019-08-28
snort ET POLICY Query to a *.opengw.net Open VPN Relay Domain rev 6 2019-08-28
snort ET TROJAN Mirai Botnet Domain Observed rev 2 2019-08-28
snort ET TROJAN Ransomware/Cerber Onion Domain Lookup rev 2 2019-08-28
snort ET POLICY DNS Query to a *.neokred domain - Likely Hostile rev 2 2019-08-28
snort ET TROJAN Observed DNS Query to Reborn/Ovidiy Stealer CnC Domain rev 2 2019-08-28
snort ET TROJAN LokiBot Related DNS query rev 3 2019-08-28
snort ET TROJAN OSX/WireLurker DNS Query Domain manhuaba.com.cn rev 2 2019-08-28
snort ET TROJAN Possible WannaCry DNS Lookup 2 rev 4 2019-08-28
snort ET TROJAN ShellCrew.APT StreamEx DNS Lookup 13 rev 2 2019-08-28
snort ET MOBILE_MALWARE Android/Bankbot.HH!tr DNS Lookup 7 rev 2 2019-08-28
snort ET TROJAN Observed AgentTesla Domain Request rev 2 2019-08-28
snort ET TROJAN PowerShell/Agent.A DNS File Transfer CnC Beacon rev 2 2019-08-28