Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.toprank21 .com domain rev 1 2024-12-20
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.toprank21 .com domain rev 1 2024-12-20
snort ET INFO DYNAMIC_DNS Query to a *.freedns .rocks domain rev 1 2024-12-19
snort ET INFO DYNAMIC_DNS HTTP Request to a *.freedns .rocks domain rev 1 2024-12-19
snort ET TROJAN Xenorat Default Handshake Inbound rev 1 2024-12-19
snort ET TROJAN Xenorat Default C2 Server Response Inbound rev 1 2024-12-19
suricata ET MALWARE Xenorat Default C2 Server Response Inbound rev 1 2024-12-19
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.freedns .rocks domain rev 1 2024-12-19
suricata ET MALWARE Xenorat Default Handshake Inbound rev 1 2024-12-19
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.freedns .rocks domain rev 1 2024-12-19
sigma DNS Query Request By QuickAssist.EXE experimental 2024-12-19
sigma AWS SAML Provider Deletion Activity experimental 2024-12-19
sigma New AWS Lambda Function URL Configuration Created experimental 2024-12-19
sigma AWS Key Pair Import Activity experimental 2024-12-19
sigma Lummac Stealer Activity - Execution Of More.com And Vbc.exe experimental 2024-12-19
sigma QuickAssist Execution experimental 2024-12-19
sigma File Creation Related To RAT Clients experimental 2024-12-19
snort ET INFO DYNAMIC_DNS HTTP Request to a *.cloudn9ne .org domain rev 1 2024-12-17
snort ET INFO DYNAMIC_DNS HTTP Request to a *.familyjam .es domain rev 1 2024-12-17
snort ET INFO DYNAMIC_DNS Query to a *.familyjam .es domain rev 1 2024-12-17
snort ET INFO DYNAMIC_DNS Query to a *.cloudn9ne .org domain rev 1 2024-12-17
snort ET TROJAN Generic Powershell Loader Using Encryption Routine Inbound rev 1 2024-12-17
suricata ET MALWARE Generic Powershell Loader Using Encryption Routine Inbound rev 1 2024-12-17
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.cloudn9ne .org domain rev 1 2024-12-17
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.familyjam .es domain rev 1 2024-12-17
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.cloudn9ne .org domain rev 1 2024-12-17
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.familyjam .es domain rev 1 2024-12-17
sigma DNS Query To Remote Access Software Domain From Non-Browser App test 2024-12-17
snort ET INFO DYNAMIC_DNS Query to a *.ospa .fi domain rev 1 2024-12-16
snort ET INFO DYNAMIC_DNS HTTP Request to a *.ospa .fi domain rev 1 2024-12-16
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.ospa .fi domain rev 1 2024-12-16
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ospa .fi domain rev 1 2024-12-16
suricata ET MALWARE [CIS] GootLoader C2 Activity - Windows 10/Server 2019/2022 - barefootinc.com[.]au rev 1 2024-12-15
suricata ET MALWARE [CIS] GootLoader C2 Activity - Windows Server 2012 R2/Windows 8.1 - barefootinc.com[.]au rev 1 2024-12-15
suricata ET MALWARE [CIS] GootLoader C2 Activity - Windows 11 - barefootinc.com[.]au rev 1 2024-12-15
suricata ET MALWARE [CIS] Gootloader C2 Activity - Windows Server 2016 - barefootinc.com[.]au rev 1 2024-12-15
snort ET INFO DYNAMIC_DNS HTTP Request to a *.indiaguru .com domain rev 1 2024-12-14
snort ET INFO DYNAMIC_DNS Query to a *.indiaguru .com domain rev 1 2024-12-14
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.indiaguru .com domain rev 1 2024-12-14
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.indiaguru .com domain rev 1 2024-12-14