Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Retdoor CnC Checkin rev 1 2024-12-09
suricata ET MALWARE Retdoor CnC Checkin rev 1 2024-12-09
sigma CVE-2024-50623 Exploitation Attempt - Cleo experimental 2024-12-09
snort ET INFO DYNAMIC_DNS Query to a *.shirokuriwaki .com domain rev 1 2024-12-07
snort ET TROJAN Supershell CnC Activity rev 1 2024-12-07
snort ET INFO DYNAMIC_DNS HTTP Request to a *.shirokuriwaki .com domain rev 1 2024-12-07
suricata ET MALWARE Supershell CnC Activity rev 1 2024-12-07
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.shirokuriwaki .com domain rev 1 2024-12-07
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.shirokuriwaki .com domain rev 1 2024-12-07
sigma Remote Access Tool Services Have Been Installed - Security test 2024-12-07
snort ET INFO DYNAMIC_DNS HTTP Request to a *.pscenergy .com domain rev 1 2024-12-06
snort ET INFO DYNAMIC_DNS Query to a *.pscenergy .com domain rev 1 2024-12-06
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.pscenergy .com domain rev 1 2024-12-06
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.pscenergy .com domain rev 1 2024-12-06
sigma Modification or Deletion of an AWS RDS Cluster experimental 2024-12-06
snort ET RETIRED Backdoor.Win32.RShot Checkin rev 2 2024-12-05
snort ET RETIRED PoisonIvy RAT/Backdoor follow on POST Data PUSH Packet rev 5 2024-12-05
snort ET INFO DYNAMIC_DNS HTTP Request to a *.joaopedroreis .com domain rev 1 2024-12-05
snort ET RETIRED PoisonIvy.Esf Keepalive to CnC rev 2 2024-12-05
snort ET CURRENT_EVENTS Bitcoin Scam Webpage Observed rev 1 2024-12-05
snort ET RETIRED PoisonIvy HTTP CnC Beacon rev 2 2024-12-05
snort ET INFO HTTP URI Path Normalization Bypasses & Escapes M2 rev 1 2024-12-05
snort ET RETIRED Blackshades Payload Download Command rev 3 2024-12-05
snort ET RETIRED W32.Blackshades/Shadesrat Backdoor CnC Beacon rev 2 2024-12-05
snort ET INFO Empty Location Header from CloudFlare Server 2024-12-05 rev 1 2024-12-05
snort ET RETIRED PoisonIvy.E Keepalive to CnC rev 5 2024-12-05
snort ET INFO DYNAMIC_DNS Query to a *.joaopedroreis .com domain rev 1 2024-12-05
snort ET TROJAN BB Trojan Communication Protocol detected rev 3 2024-12-05
snort ET RETIRED PoisonIvy.Eks Keepalive to CnC rev 2 2024-12-05
snort ET INFO HTTP URI Path Normalization Bypasses & Escapes M1 rev 1 2024-12-05
snort ET RETIRED PoisonIvy.fishplay Keepalive to CnC rev 3 2024-12-05
snort ET RETIRED BlackshadesRAT Reporting rev 5 2024-12-05
snort ET TROJAN IP2B Trojan Communication Protocol detected rev 4 2024-12-05
suricata ET RETIRED Backdoor.Win32.RShot Checkin rev 2 2024-12-05
suricata ET RETIRED W32.Blackshades/Shadesrat Backdoor CnC Beacon rev 5 2024-12-05
suricata ET PHISHING Bitcoin Scam Webpage Observed rev 1 2024-12-05
suricata ET RETIRED Blackshades Payload Download Command rev 3 2024-12-05
suricata ET RETIRED PoisonIvy.Esf Keepalive to CnC rev 2 2024-12-05
suricata ET RETIRED PoisonIvy HTTP CnC Beacon rev 5 2024-12-05
suricata ET HUNTING HTTP URI Path Normalization Bypasses & Escapes M2 rev 1 2024-12-05