Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET MALWARE Loadmoney.A Checkin 7 rev 3 2019-08-14
snort ET MALWARE Win32.LoadMoney User Agent 2 rev 2 2019-08-14
suricata ET ADWARE_PUP W32/SmartPops Adware Outbound Off-Port MSSQL Communication rev 4 2019-08-14
suricata ET ADWARE_PUP Realtimegaming.com Online Casino Spyware Gaming Checkin rev 4 2019-08-14
snort ET INFO HTTP Request to Suspicious *.desi Domain rev 2 2019-08-13
snort ET INFO HTTP Request to Suspicious *.fit Domain rev 2 2019-08-13
snort ET INFO HTTP Request to Suspicious *.okinawa Domain rev 2 2019-08-13
snort ET INFO HTTP Request to Suspicious *.ryukyu Domain rev 2 2019-08-13
snort ET INFO Observed DNS Query to .ryukyu TLD rev 2 2019-08-13
snort ET WEB_CLIENT Anonisma Paypal Phishing Uri Structure 2015-12-29 rev 4 2019-08-12
snort ET TROJAN ELF/Emptiness CnC Domain in DNS Query rev 2 2019-08-09
snort ET TROJAN ELF/Emptiness CnC Domain in DNS Query rev 2 2019-08-09
snort ET TROJAN APT Related - BLACKCOFFEE Command Delimiters in HTTP Response M1 rev 2 2019-08-09
snort ET TROJAN ELF/Emptiness v2 XOR UDP Flood Command Inbound rev 1 2019-08-09
snort ET TROJAN APT Related - BLACKCOFFEE Command Delimiters in HTTP Response M2 rev 2 2019-08-09
snort ET TROJAN ELF/Emptiness v2 XOR DNS Flood Command Inbound rev 1 2019-08-09
snort ET TROJAN ELF/Emptiness CnC Domain in DNS Query rev 2 2019-08-09
snort ET TROJAN ELF/Emptiness CnC Domain in DNS Query rev 2 2019-08-09
snort ET TROJAN ELF/Emptiness v2 XOR Update Command Inbound rev 1 2019-08-09
snort ET TROJAN ELF/Emptiness CnC Domain in DNS Query rev 2 2019-08-09
snort ET TROJAN ELF/Emptiness v2 XOR HTTP Flood Command Inbound rev 1 2019-08-09
snort ET TROJAN ELF/Mirai.shiina CnC Domain in DNS Query rev 2 2019-08-09
snort ET TROJAN ELF/Emptiness CnC Domain in DNS Query rev 2 2019-08-09
snort ET TROJAN ELF/Mirai.shiina v3 CnC Checkin rev 1 2019-08-09
snort ET TROJAN ELF/Emptiness v1.1 CnC Checkin rev 1 2019-08-09
snort ET TROJAN ELF/Emptiness CnC Domain in DNS Query rev 2 2019-08-09
snort ET TROJAN ELF/Emptiness CnC Domain in DNS Query rev 2 2019-08-09
snort ET TROJAN ELF/Emptiness v2 XOR Exec Command Inbound rev 1 2019-08-09
snort ET TROJAN ELF/Emptiness v1 CnC Checkin rev 1 2019-08-09
suricata ET MALWARE ELF/Mirai.shiina v3 CnC Checkin rev 1 2019-08-09
snort ET TROJAN Win32/Varenyky Spambot CnC in DNS Query rev 2 2019-08-08
snort ET TROJAN Win32/Varenyky Spambot CnC in DNS Query rev 2 2019-08-08
snort ET TROJAN Win32/Varenyky Spambot CnC in DNS Query rev 2 2019-08-08
snort ET TROJAN Win32/Varenyky Spambot CnC in DNS Query rev 2 2019-08-08
snort ET TROJAN Win32/Varenyky Spambot CnC in DNS Query rev 2 2019-08-08
snort ET TROJAN Win32/Varenyky Spambot CnC in DNS Query rev 2 2019-08-08
snort ET TROJAN Win32/Varenyky Spambot CnC in DNS Query rev 2 2019-08-08
snort ET TROJAN Win32/Varenyky Spambot CnC in DNS Query rev 2 2019-08-08
snort ET TROJAN Win32/Varenyky Spambot CnC in DNS Query rev 2 2019-08-08
snort ET CURRENT_EVENTS Possible Injected JS Form Stealer Checking Page Contents M1 rev 2 2019-08-07