Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN FIN8 ShellTea CnC in DNS Lookup rev 2 2019-06-13
snort ET TROJAN FIN8 ShellTea CnC in DNS Lookup rev 2 2019-06-13
snort ET TROJAN WSHRAT Credential Dump Module Download Command Inbound rev 2 2019-06-10
snort ET TROJAN Buran Ransomware Activity M1 rev 2 2019-06-10
snort ET TROJAN WSHRAT Keylogger Module Download Command Inbound rev 2 2019-06-10
snort ET TROJAN WSHRAT CnC Checkin rev 2 2019-06-10
snort ET TROJAN Win32/Phorpiex Template 4 Active - Outbound Malicious Email Spam rev 2 2019-06-06
snort ET TROJAN Win32/Phorpiex Template 3 Active - Outbound Malicious Email Spam rev 2 2019-06-06
snort ET ATTACK_RESPONSE Windows 32bit procdump Dump File Exfiltration rev 2 2019-06-05
snort ET ATTACK_RESPONSE Windows 64bit procdump Dump File Exfiltration rev 2 2019-06-05
snort ET TROJAN PLATINUM Steganographic HTTP Response Page Inbound rev 2 2019-06-05
snort ET TROJAN ICEFOG-P Variant CnC Checkin M1 rev 2 2019-06-04
snort ET CURRENT_EVENTS Successful Generic Credit Card Information Phish 2019-06-04 rev 2 2019-06-04
snort ET WEB_SERVER BlackSquid JSP Webshell Outbound rev 2 2019-06-04
snort ET TROJAN ICEFOG-P Variant CnC Checkin M2 rev 2 2019-06-04
snort ET WEB_SERVER ThinkPHP RCE Exploitation Attempt rev 3 2019-06-03
snort ET TROJAN APT28 CnC Domain DNS Lookup rev 2 2019-05-31
snort ET POLICY Inbound RDP Connection with Minimal Security Protocol Requested rev 1 2019-05-31
snort ET TROJAN APT28 CnC Domain DNS Lookup rev 2 2019-05-31
snort ET TROJAN APT28 CnC Domain DNS Lookup rev 2 2019-05-31
snort ET TROJAN APT28 CnC Domain DNS Lookup rev 2 2019-05-31
snort ET TROJAN APT28 CnC Domain DNS Lookup rev 2 2019-05-31
snort ET POLICY Inbound RDP Connection with TLS Security Protocol Requested rev 1 2019-05-31
snort ET GAMES Wolfteam HileYapak Server Response rev 2 2019-05-31
snort ET TROJAN Executable contained in DICOM Medical Image PACS DICOM Protocol Transfer rev 2 2019-05-31
snort ET TROJAN Executable contained in DICOM Medical Image SMB File Transfer rev 2 2019-05-31
snort ET TROJAN Executable contained in DICOM Medical Image Received from PACS DICOM Device rev 2 2019-05-31
snort ET TROJAN APT28 CnC Domain DNS Lookup rev 2 2019-05-31
snort ET TROJAN DarkHotel CnC Domain in DNS Lookup rev 2 2019-05-30
snort ET POLICY Spotify P2P Client rev 2 2019-05-30
snort ET TROJAN DarkHotel CnC Domain in DNS Lookup rev 2 2019-05-30
snort ET TROJAN DarkHotel Payload Uploading to CnC rev 2 2019-05-30
snort ET TROJAN DarkHotel CnC Domain in DNS Lookup rev 2 2019-05-30
snort ET TROJAN Linux/Moose NAT Traversal CnC Beacon - Sleep rev 2 2019-05-29
snort ET TROJAN Linux/HiddenWasp CnC Response rev 2 2019-05-29
snort ET TROJAN Linux/Moose NAT Traversal CnC Beacon - Multiple Tunnel rev 2 2019-05-29
snort ET WEB_SERVER China Chopper WebShell Observed Outbound rev 2 2019-05-29
snort ET TROJAN Observed DNS Query to APT10 Related CnC Domain rev 2 2019-05-28
snort ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent rev 2 2019-05-28
snort ET TROJAN Observed DNS Query to APT10 Related CnC Domain rev 2 2019-05-28