Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
suricata ET MALWARE UTA0178 Domain in TLS SNI rev 4 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET MALWARE UTA0178 Domain in DNS Lookup rev 3 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET MALWARE Suspected UTA0178 Domain in DNS Lookup rev 3 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in DNS Lookup rev 1 2024-08-09
snort ET TROJAN Possible TA399/SideWinder Related Empty .rtf Inbound rev 1 2024-08-08
snort ET TROJAN TA399/Sidewinder CnC Server Response rev 1 2024-08-08
snort ET INFO DeskTime Desktop Productivity Software Checkin rev 1 2024-08-08
suricata ET MALWARE TA399/Sidewinder CnC Server Response rev 1 2024-08-08
suricata ET MALWARE Possible TA399/SideWinder Related Empty .rtf Inbound rev 1 2024-08-08
suricata ET INFO DeskTime Desktop Productivity Software Checkin rev 1 2024-08-08
snort ET TROJAN DeerStealer Telegram Bot Response rev 1 2024-08-07