Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET RETIRED TA453 Modified IIS-Raid Backdoor Module Headers in HTTP Request rev 3 2025-04-17
sigma Suspicious Process Spawned by CentreStack Portal AppPool experimental 2025-04-17
suricata ET MALWARE zgRAT / PureLogs CnC Backdoor Server GZIP Traffic rev 1 2025-04-16
suricata ET MALWARE zgRAT / PureLogs CnC Backdoor Client GZIP Traffic rev 1 2025-04-16
snort ET CURRENT_EVENTS Observed DNS Query to TA450 Domain rev 2 2025-04-16
snort ET WEB_SERVER SonicWall SMA Post-Auth sitecustomization CGI Command Injection rev 1 2025-04-16
snort ET INFO DYNAMIC_DNS Query to a *.grupoinca .com .pe domain rev 1 2025-04-16
snort ET WEB_SERVER SonicWall SMA Post-Auth importlogo CGI File Upload rev 1 2025-04-16
snort ET INFO DYNAMIC_DNS Query to a *.yunjiaoshi .com domain rev 1 2025-04-16
snort ET CURRENT_EVENTS Observed DNS Query to UNK_RemoteRogue Domain rev 2 2025-04-16
snort ET CURRENT_EVENTS Observed DNS Query to UNK_RemoteRogue Domain rev 2 2025-04-16
snort ET INFO DYNAMIC_DNS HTTP Request to a *.grupoinca .com .pe domain rev 1 2025-04-16
snort ET INFO DYNAMIC_DNS HTTP Request to a *.yunjiaoshi .com domain rev 1 2025-04-16
snort ET CURRENT_EVENTS Observed DNS Query to UNK_RemoteRogue Domain rev 2 2025-04-16
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.yunjiaoshi .com domain rev 1 2025-04-16
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.grupoinca .com .pe domain rev 1 2025-04-16
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.yunjiaoshi .com domain rev 1 2025-04-16
suricata ET PHISHING Observed DNS Query to TA450 Domain rev 2 2025-04-16
suricata ET PHISHING Observed UNK_RemoteRogue Domain in TLS SNI rev 2 2025-04-16
suricata ET PHISHING Observed DNS Query to UNK_RemoteRogue Domain rev 2 2025-04-16
suricata ET WEB_SERVER SonicWall SMA Post-Auth sitecustomization CGI Command Injection rev 1 2025-04-16
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.grupoinca .com .pe domain rev 1 2025-04-16
suricata ET PHISHING Observed TA450 Domain in TLS SNI rev 2 2025-04-16
suricata ET PHISHING Observed UNK_RemoteRogue Domain in TLS SNI rev 2 2025-04-16
suricata ET PHISHING Observed DNS Query to UNK_RemoteRogue Domain rev 2 2025-04-16
suricata ET WEB_SERVER SonicWall SMA Post-Auth importlogo CGI File Upload rev 1 2025-04-16
suricata ET PHISHING Observed UNK_RemoteRogue Domain in TLS SNI rev 2 2025-04-16
suricata ET PHISHING Observed DNS Query to UNK_RemoteRogue Domain rev 2 2025-04-16
sigma Obfuscated PowerShell OneLiner Execution test 2025-04-16
suricata ET MALWARE zgRAT / PureLogs CnC GZIP Exfiltration Outbound rev 1 2025-04-15
snort ET TROJAN zgRAT / PureLogs CnC GZIP Exfiltration Outbound rev 1 2025-04-15
snort ET INFO DYNAMIC_DNS Query to a *.efeerp .com domain rev 2 2025-04-15
snort ET INFO DYNAMIC_DNS HTTP Request to a *.efeerp .com domain rev 2 2025-04-15
snort ET TROJAN Observed DNS Query to TA427 Domain rev 1 2025-04-15
snort ET TROJAN DeerStealer Websocket Initial Request rev 1 2025-04-15
snort ET TROJAN Unk Loader Host Profiling Data Exfiltration Attempt rev 1 2025-04-15
snort ET TROJAN SNOWLIGHT C2 HTTP Requests rev 1 2025-04-15
suricata ET MALWARE Observed DNS Query to TA427 Domain rev 1 2025-04-15
suricata ET MALWARE SNOWLIGHT C2 HTTP Requests rev 1 2025-04-15
suricata ET MALWARE DeerStealer Websocket Initial Request rev 1 2025-04-15