Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET RETIRED Night Dragon CnC Traffic Outbound 2 rev 7 2024-12-03
suricata ET RETIRED Backdoor.Win32.ZZSlash/Redosdru.E checkin rev 3 2024-12-03
suricata ET RETIRED Dropper.Win32.Agent.bpxo Checkin rev 5 2024-12-03
suricata ET RETIRED Win32.Cerberus RAT Checkin Response rev 3 2024-12-03
suricata ET RETIRED Bifrose Client Checkin rev 3 2024-12-03
suricata ET RETIRED Dropper.Win32.Agent.ahju Checkin rev 3 2024-12-03
suricata ET RETIRED Ruskill/Palevo KCIK IRC Command rev 6 2024-12-03
suricata ET RETIRED Night Dragon CnC Beacon Outbound rev 5 2024-12-03
suricata ET RETIRED W32/Badlib Connectivity Check To Department of Defense Intelligence Information Systems rev 2 2024-12-03
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.christopherharmon .net domain rev 1 2024-12-03
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.christopherharmon .net domain rev 1 2024-12-03
sigma NetNTLM Downgrade Attack - Registry test 2024-12-03
snort ET INFO DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net rev 10 2024-12-01
snort ET INFO DYNAMIC_DNS Query to a *.dtdns.net Domain rev 7 2024-12-01
snort ET INFO DYNAMIC_DNS Query to a *.trudireaume .com domain rev 2 2024-12-01
snort ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain rev 11 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a *.3d-game.com Domain rev 4 2024-12-01
snort ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com rev 8 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a *.darktech.org Domain rev 5 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a *.flnet.org Domain rev 4 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a 3322.net Domain *.8800.org rev 8 2024-12-01
snort ET INFO DYNAMIC_DNS Query to a Suspicious *.dnsip.ru Domain rev 4 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a *.dtdns.net Domain rev 7 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.org rev 9 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-web.com Domain rev 5 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a *.4irc.com Domain rev 4 2024-12-01
snort ET INFO DYNAMIC_DNS Query to a *.etowns.net Domain rev 7 2024-12-01
snort ET INFO DYNAMIC_DNS Query to a Suspicious *.dyndns-web.com Domain rev 6 2024-12-01
snort ET INFO DYNAMIC_DNS Query to a *.ekcal .com domain rev 1 2024-12-01
snort ET INFO DYNAMIC_DNS Query to a *.b0ne.com Domain rev 7 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a *.bbsindex.com Domain rev 4 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a *.dnsalias.ru Domain rev 4 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a 3322.net Domain *.9966.org rev 8 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a 3322.net Domain *.6600.org rev 8 2024-12-01
snort ET INFO DYNAMIC_DNS Query to a *.scieron.com Domain rev 7 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a 3322.net Domain *.7766.org rev 9 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a *.etowns.net Domain rev 4 2024-12-01
snort ET INFO DYNAMIC_DNS Query to a *.bbsindex.com Domain rev 7 2024-12-01
snort ET INFO DYNAMIC_DNS HTTP Request to a *.zolik .com Domain rev 3 2024-12-01
snort ET INFO DYNAMIC_DNS Query to a *.mrbasic.com Domain rev 4 2024-12-01