Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET RETIRED Bitter APT ZxxZ Downloader CnC Checkin rev 2 2024-09-17
snort ET RETIRED ZuoRAT send_http_msg_php Call to ssid.php rev 3 2024-09-17
snort ET RETIRED Win32/MagicRAT Additional Payload URI M1 rev 2 2024-09-17
snort ET RETIRED Win32/Caypnamer.A RAT CnC Initial Checkin rev 5 2024-09-17
snort ET RETIRED Android/IRATA Data Exfiltration Attempt rev 2 2024-09-17
snort ET RETIRED Trojan.Proxy.Small.Z CnC Checkin rev 2 2024-09-17
snort ET RETIRED Win32/Wacatac.B!ml CnC Checkin rev 3 2024-09-17
snort ET RETIRED Win32/MagicRAT Additional Payload URI M4 rev 2 2024-09-17
suricata ET RETIRED NoMercy Stealer CnC Checkin rev 3 2024-09-17
suricata ET RETIRED Win32/TrojanDownloader.VB.RTN Payload Delivery Request rev 3 2024-09-17
suricata ET RETIRED Win32/Caypnamer.A RAT CnC Initial Checkin rev 4 2024-09-17
suricata ET RETIRED Bitter APT ZxxZ Downloader CnC Checkin rev 3 2024-09-17
suricata ET RETIRED SAFIB Assistant Remote Administration Tool CnC Checkin rev 4 2024-09-17
suricata ET RETIRED Win32/HackTool.Agent.CS SMTP Scanner CnC Checkin rev 3 2024-09-17
suricata ET RETIRED Trojan.Proxy.Small.Z CnC Checkin rev 3 2024-09-17
suricata ET RETIRED ZuoRAT send_http_msg_php Call to arp.php rev 4 2024-09-17
suricata ET RETIRED NoMercy Data Exfiltration M1 rev 3 2024-09-17
suricata ET RETIRED ZuoRAT GoBeacon CnC rev 3 2024-09-17
suricata ET RETIRED Win32/MagicRAT CnC Checkin M1 rev 4 2024-09-17
suricata ET RETIRED Win32/Agent.Fish Data Exfiltration rev 3 2024-09-17
suricata ET RETIRED Android/IRATA Data Exfiltration Attempt rev 3 2024-09-17
suricata ET RETIRED Win32/Swjoy.A Telemetry Checkin rev 3 2024-09-17
suricata ET RETIRED Win32/Wacatac.B!ml CnC Checkin rev 4 2024-09-17
suricata ET RETIRED Troj_Yahoya Variant CnC Checkin rev 3 2024-09-17
suricata ET RETIRED HTTPRevShell Initial CnC Checkin rev 3 2024-09-17
suricata ET RETIRED Win32/MagicRAT Additional Payload URI M2 rev 4 2024-09-17
suricata ET RETIRED Win32/MagicRAT Additional Payload URI M4 rev 4 2024-09-17
suricata ET RETIRED ZuoRAT send_http_msg_php Call to ssid.php rev 4 2024-09-17
suricata ET RETIRED Woody RAT CnC Checkin rev 3 2024-09-17
suricata ET RETIRED Win32/MagicRAT Additional Payload URI M3 rev 4 2024-09-17
suricata ET RETIRED NoMercy Data Exfiltration M2 rev 3 2024-09-17
suricata ET RETIRED ZuoRAT send_http_msg_php Call to dns.php rev 4 2024-09-17
suricata ET RETIRED Win32/Criminal RAT CnC Checkin rev 3 2024-09-17
suricata ET RETIRED Win32/TrojanDownloader.AutoHK.MT CnC Checkin rev 5 2024-09-17
suricata ET RETIRED Win32.Stealer.alwu Data Exfiltration Attempt rev 3 2024-09-17
suricata ET RETIRED Win32/MagicRAT Additional Payload URI M1 rev 4 2024-09-17
suricata ET RETIRED Win32/MagicRAT CnC Checkin M2 rev 4 2024-09-17
suricata ET RETIRED Shuckworm Backdoor Screenshot Upload Attempt rev 4 2024-09-17
snort ET INFO DYNAMIC_DNS HTTP Request to a * .caminolafusta .cl Domain rev 2 2024-09-16
snort ET RETIRED Win/Malware.Filetour Variant Checkin M2 rev 2 2024-09-16