Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.efeerp .com domain rev 2 2025-04-15
suricata ET MALWARE Observed DNS Query to TA427 Domain rev 1 2025-04-15
suricata ET MALWARE SNOWLIGHT C2 HTTP Requests rev 1 2025-04-15
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.efeerp .com domain rev 2 2025-04-15
suricata ET MALWARE Unk Loader Host Profiling Data Exfiltration Attempt rev 1 2025-04-15
snort ET INFO DYNAMIC_DNS HTTP Request to a *.kazoodle .com domain rev 1 2025-04-14
snort ET INFO DYNAMIC_DNS Query to a *.kazoodle .com domain rev 1 2025-04-14
snort ET TROJAN Specter Insight Beacon CnC Checkin M3 rev 1 2025-04-14
snort ET WEB_SERVER SonicWall SRA Post-Auth gencsr CGI Command Injection rev 1 2025-04-14
snort ET TROJAN Specter Insight Beacon CnC Checkin M2 rev 1 2025-04-14
snort ET TROJAN Specter Insight Beacon CnC Checkin M1 rev 2 2025-04-14
snort ET EXPLOIT SonicWall SMA Authenticated Command Injection Attempt CVE-2021-20039 rev 2 2025-04-14
suricata ET WEB_SERVER SonicWall SRA Post-Auth gencsr CGI Command Injection rev 1 2025-04-14
suricata ET MALWARE Specter Insight Beacon CnC Checkin M3 rev 1 2025-04-14
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.kazoodle .com domain rev 1 2025-04-14
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.kazoodle .com domain rev 1 2025-04-14
suricata ET EXPLOIT SonicWall SMA Authenticated Command Injection Attempt CVE-2021-20039 rev 3 2025-04-14
suricata ET MALWARE Specter Insight Beacon CnC Checkin M1 rev 2 2025-04-14
suricata ET MALWARE Specter Insight Beacon CnC Checkin M2 rev 1 2025-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.inoa .cl domain rev 1 2025-04-12
snort ET INFO DYNAMIC_DNS Query to a *.inoa .cl domain rev 1 2025-04-12
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.inoa .cl domain rev 1 2025-04-12
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.inoa .cl domain rev 1 2025-04-12
sigma Potential Binary Impersonating Sysinternals Tools test 2025-04-12
snort ET INFO DYNAMIC_DNS HTTP Request to a *.wittesolutions .com domain rev 1 2025-04-11
snort ET INFO DYNAMIC_DNS Query to a *.aspdebugger .com domain rev 1 2025-04-11
snort ET INFO DYNAMIC_DNS Query to a *.megaingenieria .com domain rev 1 2025-04-11
snort ET INFO DYNAMIC_DNS HTTP Request to a *.megaingenieria .com domain rev 1 2025-04-11
snort ET EXPLOIT Belkin N750 Buffer Overflow Attempt rev 3 2025-04-11
snort ET INFO DYNAMIC_DNS Query to a *.wittesolutions .com domain rev 1 2025-04-11
snort ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M3 rev 2 2025-04-11
snort ET TROJAN Trox Stealer System Profiling Data Exfiltration Attempt rev 1 2025-04-11
snort ET TROJAN StealC v2 CnC Server Response rev 1 2025-04-11
snort ET INFO DYNAMIC_DNS HTTP Request to a *.aspdebugger .com domain rev 1 2025-04-11
suricata ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M3 rev 2 2025-04-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.aspdebugger .com domain rev 1 2025-04-11
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.megaingenieria .com domain rev 1 2025-04-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.wittesolutions .com domain rev 1 2025-04-11
suricata ET EXPLOIT Belkin N750 Buffer Overflow Attempt rev 6 2025-04-11
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.wittesolutions .com domain rev 1 2025-04-11