Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET RETIRED WinGo/Go-rod signInUrls Failed Data Exfiltration attempt rev 2 2024-09-18
snort ET RETIRED Win32/Cryptbot V2 Data Exfiltration Attempt rev 5 2024-09-18
snort ET RETIRED Gamaredon Information Stealer Data Exfiltration Attempt rev 3 2024-09-18
snort ET RETIRED Win32/QQPass Checkin rev 2 2024-09-18
snort ET RETIRED Win32/Spy.Delf.QTL Data Exfiltration Attempt rev 2 2024-09-18
snort ET RETIRED TA404/Zinc Trojanized muPDF/Subliminal CnC Checkin rev 2 2024-09-18
snort ET RETIRED Win32/SaintStealer Data Exfiltration Attempt M1 rev 2 2024-09-18
snort ET RETIRED Win32/SaintStealer Data Exfiltration Attempt M2 rev 2 2024-09-18
snort ET RETIRED TA404/Zinc Trojanized KiTTY CnC Checkin rev 2 2024-09-18
suricata ET RETIRED TA404/Zinc Trojanized muPDF/Subliminal CnC Checkin rev 4 2024-09-18
suricata ET RETIRED Win32/SaintStealer Data Exfiltration Attempt M2 rev 3 2024-09-18
suricata ET RETIRED Gamaredon Information Stealer Data Exfiltration Attempt rev 2 2024-09-18
suricata ET RETIRED WinGo/Go-rod signInUrls Failed Data Exfiltration attempt rev 3 2024-09-18
suricata ET RETIRED Win32/Cryptbot V2 Data Exfiltration Attempt rev 7 2024-09-18
suricata ET RETIRED Win32/SaintStealer Data Exfiltration Attempt M1 rev 4 2024-09-18
suricata ET RETIRED Win32/QQPass Checkin rev 3 2024-09-18
suricata ET RETIRED TA404/Zinc Trojanized KiTTY CnC Checkin rev 4 2024-09-18
suricata ET RETIRED Win32/Spy.Delf.QTL Data Exfiltration Attempt rev 3 2024-09-18
snort ET RETIRED NoMercy Stealer CnC Checkin rev 2 2024-09-17
snort ET RETIRED Win32/Criminal RAT CnC Checkin rev 2 2024-09-17
snort ET RETIRED HTTPRevShell Initial CnC Checkin rev 2 2024-09-17
snort ET RETIRED Win32/MagicRAT Additional Payload URI M2 rev 2 2024-09-17
snort ET RETIRED Shuckworm Backdoor Screenshot Upload Attempt rev 2 2024-09-17
snort ET RETIRED NoMercy Data Exfiltration M2 rev 2 2024-09-17
snort ET RETIRED Win32/MagicRAT Additional Payload URI M3 rev 2 2024-09-17
snort ET RETIRED Android/IRATA Data Exfiltration Attempt rev 2 2024-09-17
snort ET RETIRED ZuoRAT send_http_msg_php Call to dns.php rev 3 2024-09-17
snort ET RETIRED Win32.Stealer.alwu Data Exfiltration Attempt rev 2 2024-09-17
snort ET RETIRED ZuoRAT send_http_msg_php Call to ssid.php rev 3 2024-09-17
snort ET RETIRED Woody RAT CnC Checkin rev 2 2024-09-17
snort ET RETIRED SAFIB Assistant Remote Administration Tool CnC Checkin rev 2 2024-09-17
snort ET RETIRED Troj_Yahoya Variant CnC Checkin rev 2 2024-09-17
snort ET RETIRED Win32/MagicRAT Additional Payload URI M4 rev 2 2024-09-17
snort ET RETIRED Win32/Caypnamer.A RAT CnC Initial Checkin rev 5 2024-09-17
snort ET RETIRED Win32/Wacatac.B!ml CnC Checkin rev 3 2024-09-17
snort ET RETIRED Win32/MagicRAT CnC Checkin M2 rev 2 2024-09-17
snort ET RETIRED Win32/TrojanDownloader.AutoHK.MT CnC Checkin rev 4 2024-09-17
snort ET RETIRED ZuoRAT send_http_msg_php Call to arp.php rev 3 2024-09-17
snort ET RETIRED Win32/MagicRAT Additional Payload URI M1 rev 2 2024-09-17
snort ET RETIRED Trojan.Proxy.Small.Z CnC Checkin rev 2 2024-09-17