Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN CommentCrew Possible APT crabdance backdoor base64 head rev 3 2014-09-19
snort ET TROJAN OneLouder EXE download possibly installing Zeus P2P rev 3 2014-09-19
snort ET TROJAN Gh0st Trojan CnC 2 rev 3 2014-09-19
snort ET TROJAN Zeus.Downloader Campaign Unknown Initial CnC Beacon rev 3 2014-09-19
snort ET TROJAN CommentCrew downloader without user-agent string exe download without User Agent rev 2 2014-09-19
snort ET TROJAN W32/Tobfy.Ransomware Invalid URI CnC Request rev 3 2014-09-19
snort ET TROJAN Kuluoz/Asprox CnC Response rev 2 2014-09-18
snort ET P2P BitTorrent Traffic rev 9 2014-09-18
snort ET WEB_SERVER HTTP POST Generic eval of base64_decode rev 1 2014-09-16
snort ET INFO HTTP Request to a *.cz.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.c0m.li domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.ch.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.at.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.upas.su domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.de.tf domain rev 2 2014-09-15
snort ET TROJAN Urlzone/Bebloh/Bublik Checkin /was/vas.php rev 4 2014-09-15
snort ET INFO HTTP Request to a 3322.org.cn Domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.int.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.ru.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a .noip.cn domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.bg.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.dtdns.net domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.osa.pl domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.pl.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.eu.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.us.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.nl.ai domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.xe.cx domain rev 2 2014-09-15
snort ET WEB_CLIENT Likely MS12-004 midiOutPlayNextPolyEvent Heap Overflow Midi Filename Requested baby.mid rev 2 2014-09-15
snort ET INFO HTTP Request to a *.sg.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.orge.pl Domain rev 3 2014-09-15
snort ET INFO HTTP Request to a *.ca.tf domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.co.com.au domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.de.ms domain rev 2 2014-09-15
snort ET TROJAN Win32.HLLW.Autoruner USA_Load UA rev 2 2014-09-15
snort ET TROJAN Possible SKyWIper/Win32.Flame POST rev 6 2014-09-15
snort ET INFO HTTP Request to a *.uni.cc domain rev 2 2014-09-15
snort ET INFO HTTP Request to a *.edu.tf domain rev 2 2014-09-15
snort ET POLICY HTTP Request to a *.dlinkddns.com domain rev 3 2014-09-13
snort ET TROJAN Possible Tracur.Q HTTP Communication rev 2 2014-09-13