Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN NamelessC2 SSL/TLS Certificate Observed rev 1 2024-09-30
suricata ET RETIRED GCleaner CnC Checkin M1 rev 4 2024-09-30
suricata ET RETIRED APT37 M2RAT CnC Server Command - URL rev 3 2024-09-30
suricata ET RETIRED Win32/S1deload Stealer CnC Checkin - Get Tasking rev 4 2024-09-30
suricata ET RETIRED Win32/VoipRaider Data Collection Attempt rev 3 2024-09-30
suricata ET RETIRED Playful Taurus Malicious SSL Certificate Observed rev 3 2024-09-30
suricata ET RETIRED SOMNIRECORD Backdoor PROBE Command in DNS Query rev 5 2024-09-30
suricata ET RETIRED SOMNIRECORD Backdoor DATA Command in DNS Query rev 5 2024-09-30
suricata ET RETIRED GCleaner CnC Checkin M2 rev 4 2024-09-30
suricata ET RETIRED Potential GCleaner CnC Checkin rev 7 2024-09-30
suricata ET RETIRED GCleaner Payload Retrieval Attempt rev 4 2024-09-30
suricata ET RETIRED Patchwork APT BADNEWS Variant CnC Checkin M2 rev 4 2024-09-30
suricata ET RETIRED APT37 M2RAT CnC Server Command - CMD rev 3 2024-09-30
suricata ET RETIRED Vidar Stealer CnC Checkin rev 3 2024-09-30
suricata ET RETIRED Parallax CnC Response Activity M18 rev 3 2024-09-30
suricata ET RETIRED APT37 M2RAT CnC Server Command - OKR rev 3 2024-09-30
suricata ET RETIRED Sharp Panda Soul Framework CnC Checkin rev 4 2024-09-30
suricata ET RETIRED Win32/PSWStealer Data Exfiltration Attempt rev 3 2024-09-30
suricata ET RETIRED Crashedtech Loader CnC Checkin rev 3 2024-09-30
suricata ET RETIRED Malvirt/KoiVM Downloader Variant Payload Retrieval Request rev 3 2024-09-30
suricata ET RETIRED LogStih Stealer Data Exfiltration Attempt rev 4 2024-09-30
suricata ET RETIRED APT37 M2RAT CnC Server Command - UPD rev 3 2024-09-30
suricata ET RETIRED Patchwork APT BADNEWS Variant CnC Checkin M1 rev 4 2024-09-30
suricata ET RETIRED Win32/Wacatac.B!ml Data Exfiltration rev 2 2024-09-30
suricata ET RETIRED APT37 M2RAT CnC Server Command - UNI rev 3 2024-09-30
suricata ET RETIRED MSIL/PSW.Agent.STP Data Exfiltration Attempt rev 3 2024-09-30
suricata ET MALWARE NamelessC2 SSL/TLS Certificate Observed rev 1 2024-09-30
suricata ET RETIRED LogStih Stealer CnC Checkin rev 4 2024-09-30
suricata ET RETIRED SOMNIRECORD Backdoor CMD Command in DNS Query rev 3 2024-09-30
suricata ET RETIRED APT37 M2RAT CnC Server Command - RES rev 3 2024-09-30
suricata ET RETIRED Hiatus RAT CnC Checkin rev 4 2024-09-30
suricata ET RETIRED Win32/Fabookie.ek CnC Domain in DNS Lookup rev 3 2024-09-30
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page M2 2024-09-27 rev 1 2024-09-28
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page M1 2024-09-27 rev 1 2024-09-28
suricata ET PHISHING Generic Credential Phish Landing Page M2 2024-09-27 rev 1 2024-09-28
suricata ET PHISHING Generic Credential Phish Landing Page M1 2024-09-27 rev 1 2024-09-28
snort ET TROJAN TA399/Sidewinder Activity Payload Request M1, Microsoft Outlook UA Request for .rtf rev 5 2024-09-26
snort ET TROJAN TA399/Sidewinder Activity Payload Request M3, Microsoft Word UA Request for .rtf rev 7 2024-09-26
snort ET TROJAN TA399/Sidewinder Activity Payload Request M2, Microsoft Office UA Request for .rtf rev 5 2024-09-26
snort ET INFO Observed Server Responding with PDD File With Known Dangerous/Exploitable Parameter rev 1 2024-09-26