Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.lawson-engineers .co .uk domain rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.hollandweather .net domain rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.copyprint .com .ar domain rev 1 2025-09-09
suricata ET MALWARE LimeRAT Exfiltrating RDP Credentials via Telegram rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.elliott .ca domain rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.lodgegomantak .org domain rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.dmdistribution .net domain rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.rileytree .org domain rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.jmmipequenomundo .com .ar domain rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.lawson-engineers .co .uk domain rev 1 2025-09-09
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.elliott .ca domain rev 1 2025-09-09
snort ET INFO DYNAMIC_DNS HTTP Request to a *.start168 .com domain rev 1 2025-09-08
snort ET INFO DYNAMIC_DNS HTTP Request to a *.stockcity .ru domain rev 1 2025-09-08
snort ET INFO DYNAMIC_DNS Query to a *.skam .co domain rev 1 2025-09-08
snort ET INFO DYNAMIC_DNS HTTP Request to a *.skam .co domain rev 1 2025-09-08
snort ET INFO DYNAMIC_DNS Query to a *.start168 .com domain rev 1 2025-09-08
snort ET INFO DYNAMIC_DNS Query to a *.stockcity .ru domain rev 1 2025-09-08
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.skam .co domain rev 1 2025-09-08
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.start168 .com domain rev 1 2025-09-08
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.stockcity .ru domain rev 1 2025-09-08
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.stockcity .ru domain rev 1 2025-09-08
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.start168 .com domain rev 1 2025-09-08
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.skam .co domain rev 1 2025-09-08
snort ET INFO DYNAMIC_DNS HTTP Request to a *.delcarmen .cl domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS HTTP Request to a *.malmo .cl domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS HTTP Request to a *.skamaria .com domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS HTTP Request to a *.ocxpressit .com domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS Query to a *.esal .cl domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS Query to a *.warhawkenterprises .com domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS Query to a *.malmo .cl domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS Query to a *.ocxpressit .com domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS HTTP Request to a *.esal .cl domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS HTTP Request to a *.mvle .com .ar domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS Query to a *.mycrossfire .net domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS HTTP Request to a *.warhawkenterprises .com domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS Query to a *.skamaria .com domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS HTTP Request to a *.mycrossfire .net domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS Query to a *.escribaniarusso .com .ar domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS HTTP Request to a *.escribaniarusso .com .ar domain rev 1 2025-09-07
snort ET INFO DYNAMIC_DNS Query to a *.mvle .com .ar domain rev 1 2025-09-07