Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Observed DNS Query to UNK_DropPitch Domain rev 1 2025-07-14
snort ET INFO DYNAMIC_DNS Query to a *.adventuregameclub .com domain rev 1 2025-07-14
snort ET RETIRED Win32/SSLoad Payload Response rev 2 2025-07-14
snort ET RETIRED JLORAT CnC Checkin rev 3 2025-07-14
snort ET TROJAN Observed DNS Query to UNK_DropPitch Domain rev 1 2025-07-14
snort ET INFO DYNAMIC_DNS Query to a *.martyluther .com domain rev 1 2025-07-14
snort ET RETIRED BunnyLoader Initial CnC Checkin Response rev 2 2025-07-14
snort ET TROJAN Voldemort System Info Exfil rev 1 2025-07-14
suricata ET MALWARE Observed DNS Query to UNK_DropPitch Domain rev 1 2025-07-14
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.martyluther .com domain rev 1 2025-07-14
suricata ET MALWARE Observed UNK_DropPitch Domain in TLS SNI rev 1 2025-07-14
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.adventuregameclub .com domain rev 1 2025-07-14
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.myowndamnnode .com domain rev 1 2025-07-14
suricata ET MALWARE Observed DNS Query to UNK_DropPitch Domain rev 1 2025-07-14
suricata ET RETIRED TheMoon CnC Checkin rev 3 2025-07-14
suricata ET MALWARE Observed UNK_DropPitch Domain in TLS SNI rev 1 2025-07-14
suricata ET RETIRED MacOS/MacStealer Data Exfiltration Attempt rev 3 2025-07-14
suricata ET RETIRED JynxLoaderV2 CnC Checkin rev 3 2025-07-14
suricata ET MALWARE Voldemort System Info Exfil rev 1 2025-07-14
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.adventuregameclub .com domain rev 1 2025-07-14
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.martyluther .com domain rev 1 2025-07-14
suricata ET RETIRED JLORAT CnC Checkin rev 3 2025-07-14
suricata ET PHISHING Observed TA461 Domain in TLS SNI rev 1 2025-07-14
suricata ET RETIRED Win32/SSLoad Payload Response rev 3 2025-07-14
suricata ET RETIRED TA421 Wineloader CnC Checkin rev 3 2025-07-14
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.myowndamnnode .com domain rev 1 2025-07-14
suricata ET MALWARE Numinon CnC Activity via WebSockets rev 1 2025-07-14
suricata ET RETIRED BunnyLoader Initial CnC Checkin Response rev 2 2025-07-14
sigma Potential SSH Tunnel Persistence Install Using A Scheduled Task experimental 2025-07-14
suricata ET EXPLOIT HTTP POST with Common Ruby RCE Technique in Body rev 1 2025-07-13
snort ET INFO DYNAMIC_DNS Query to a *.ryanng .com domain rev 1 2025-07-12
snort ET INFO DYNAMIC_DNS HTTP Request to a *.ryanng .com domain rev 1 2025-07-12
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.ryanng .com domain rev 1 2025-07-12
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ryanng .com domain rev 1 2025-07-12
sigma COM Hijacking via TreatAs test 2025-07-11
sigma PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction' experimental 2025-07-11
sigma Suspicious Volume Shadow Copy VSS_PS.dll Load test 2025-07-11
sigma Windows Defender Threat Severity Default Action Modified experimental 2025-07-11
sigma Transferring Files with Credential Data via Network Shares test 2025-07-11
snort ET INFO DYNAMIC_DNS Query to a *.coybu .com domain rev 1 2025-07-10