Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Lumma Stealer Victim Profile Exfil rev 1 2025-09-10
snort ET INFO DYNAMIC_DNS HTTP Request to a *.xenor .ro domain rev 1 2025-09-10
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.xeonxu .info domain rev 1 2025-09-10
suricata ET MALWARE TinyNuke Exfil User Profile via Telegram rev 1 2025-09-10
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.sch-design .com .ar domain rev 1 2025-09-10
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.xeonxu .info domain rev 1 2025-09-10
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.dadyal .pk domain rev 1 2025-09-10
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.abbotsfordhallforhire .org .au domain rev 1 2025-09-10
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.xenor .ro domain rev 1 2025-09-10
suricata ET MALWARE TinyNuke Checkin via Telegram rev 1 2025-09-10
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.certified .cl domain rev 1 2025-09-10
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.abbotsfordhallforhire .org .au domain rev 1 2025-09-10
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.sch-design .com .ar domain rev 1 2025-09-10
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.xenor .ro domain rev 1 2025-09-10
suricata ET MALWARE Lumma Stealer Victim Profile Exfil rev 1 2025-09-10
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.dadyal .pk domain rev 1 2025-09-10
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.certified .cl domain rev 1 2025-09-10
snort ET INFO DYNAMIC_DNS HTTP Request to a *.lodgegomantak .org domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS HTTP Request to a *.dmdistribution .net domain rev 1 2025-09-09
snort ET TROJAN LimeRAT Exfiltrating RDP Credentials via Telegram rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS Query to a *.lodgegomantak .org domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS HTTP Request to a *.hollandweather .net domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS HTTP Request to a *.copyprint .com .ar domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS Query to a *.copyprint .com .ar domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS HTTP Request to a *.rileytree .org domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS Query to a *.jmmipequenomundo .com .ar domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS Query to a *.lawson-engineers .co .uk domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS HTTP Request to a *.lawson-engineers .co .uk domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS Query to a *.rileytree .org domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS Query to a *.dmdistribution .net domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS Query to a *.elliott .ca domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS HTTP Request to a *.jmmipequenomundo .com .ar domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS HTTP Request to a *.elliott .ca domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS Query to a *.hollandweather .net domain rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.copyprint .com .ar domain rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.hollandweather .net domain rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.jmmipequenomundo .com .ar domain rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.lawson-engineers .co .uk domain rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.hollandweather .net domain rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.elliott .ca domain rev 1 2025-09-09