Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING TA453 Domain in TLS SNI rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in DNS Lookup rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in DNS Lookup rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in DNS Lookup rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in DNS Lookup rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in DNS Lookup rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in TLS SNI rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in DNS Lookup rev 1 2025-03-10
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.mundra .com domain rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in DNS Lookup rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in DNS Lookup rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in DNS Lookup rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in TLS SNI rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in TLS SNI rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in TLS SNI rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in TLS SNI rev 1 2025-03-10
suricata ET PHISHING TA453 Domain in TLS SNI rev 1 2025-03-10
snort ET INFO DYNAMIC_DNS Query to a *.gmk .cl domain rev 1 2025-03-09
snort ET INFO DYNAMIC_DNS HTTP Request to a *.gmk .cl domain rev 1 2025-03-09
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.gmk .cl domain rev 1 2025-03-09
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.gmk .cl domain rev 1 2025-03-09
snort ET INFO DYNAMIC_DNS HTTP Request to a *.veronicabazan .cl domain rev 1 2025-03-08
snort ET INFO DYNAMIC_DNS Query to a *.veronicabazan .cl domain rev 1 2025-03-08
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.veronicabazan .cl domain rev 1 2025-03-08
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.veronicabazan .cl domain rev 1 2025-03-08
snort ET ATTACK_RESPONSE ClickFix MSHTA Command Inbound rev 1 2025-03-07
snort ET TROJAN Observed POST to ClickFix Style URI M1 rev 1 2025-03-07
snort ET INFO DYNAMIC_DNS HTTP Request to a *.komodojantan .com domain rev 1 2025-03-07
snort ET TROJAN Observed GET to ClickFix Style URI M1 rev 1 2025-03-07
snort ET INFO DYNAMIC_DNS Query to a *.komodojantan .com domain rev 1 2025-03-07
suricata ET MALWARE Observed GET to ClickFix Style URI M1 rev 1 2025-03-07
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.komodojantan .com domain rev 1 2025-03-07
suricata ET MALWARE Observed POST to ClickFix Style URI M1 rev 1 2025-03-07
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.komodojantan .com domain rev 1 2025-03-07
suricata ET ATTACK_RESPONSE ClickFix MSHTA Command Inbound rev 1 2025-03-07
snort ET TROJAN AsyncRAT Installer Payload Request rev 1 2025-03-06
suricata ET MALWARE AsyncRAT Installer Payload Request rev 1 2025-03-06
sigma Whoami.EXE Execution Anomaly test 2025-03-06
sigma Potential WinAPI Calls Via CommandLine test 2025-03-06
sigma Windows Processes Suspicious Parent Directory test 2025-03-06