Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET DYN_DNS DYNAMIC_DNS Query to .giswebservice .com Domain rev 2 2024-06-21
suricata ET DYN_DNS DYNAMIC_DNS Query to .afshin .ir Domain rev 2 2024-06-21
suricata ET MOBILE_MALWARE Android Rafel RAT Checkin M1 rev 1 2024-06-21
sigma Potential Windows Defender AV Bypass Via Dump64.EXE Rename test 2024-06-21
sigma Potential Proxy Execution Via Explorer.EXE From Shell Process test 2024-06-21
snort ET TROJAN Win32/ProcessKiller CnC Initialization M2 rev 1 2024-06-20
snort ET TROJAN Suspected Powershell Empire Activity M3 rev 1 2024-06-20
snort ET TROJAN Suspicious POST With Reference to WINDOWS Folder Possible Malware Infection rev 15 2024-06-20
snort ET TROJAN Fickle Stealer C2 Server Tasking rev 1 2024-06-20
snort ET TROJAN Suspected Powershell Empire Activity M2 rev 1 2024-06-20
snort ET TROJAN Suspected Powershell Empire Activity M1 rev 1 2024-06-20
snort ET TROJAN ClickFix Obfuscated Payload Inbound rev 1 2024-06-20
suricata ET MALWARE Suspected Powershell Empire Activity M3 rev 1 2024-06-20
suricata ET MALWARE Suspected Powershell Empire Activity M1 rev 1 2024-06-20
suricata ET HUNTING Suspicious POST With Reference to WINDOWS Folder Possible Malware Infection rev 19 2024-06-20
suricata ET MALWARE ClickFix Obfuscated Payload Inbound rev 1 2024-06-20
suricata ET MALWARE Win32/ProcessKiller CnC Initialization M2 rev 1 2024-06-20
suricata ET MALWARE Fickle Stealer C2 Server Tasking rev 1 2024-06-20
suricata ET MALWARE Suspected Powershell Empire Activity M2 rev 1 2024-06-20
snort ET CURRENT_EVENTS Parrot TDS Check 2024-06-17 rev 1 2024-06-17
snort ET TROJAN Win32/Tibs Checkin rev 10 2024-06-17
suricata ET ADWARE_PUP Win32/Tibs Checkin rev 10 2024-06-17
suricata ET EXPLOIT_KIT Parrot TDS Check 2024-06-17 rev 1 2024-06-17
sigma Communication To LocaltoNet Tunneling Service Initiated test 2024-06-17
sigma Communication To LocaltoNet Tunneling Service Initiated - Linux test 2024-06-17
snort ET TROJAN Win64/TrojanDownloader.Agent.AUO User Agent rev 1 2024-06-14
snort ET INFO Serialized Java Object Calling Common Collection Function rev 2 2024-06-14
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page 2024-06-13 rev 1 2024-06-14
suricata ET INFO Serialized Java Object Calling Common Collection Function rev 3 2024-06-14
suricata ET PHISHING Generic Credential Phish Landing Page 2024-06-13 rev 1 2024-06-14
suricata ET MALWARE Win64/TrojanDownloader.Agent.AUO User Agent rev 1 2024-06-14
suricata ET FILE_SHARING Observed Anonymous File Sharing Service Domain in TLS SNI rev 2 2024-06-14
snort ET USER_AGENTS Go HTTP Client User-Agent rev 3 2024-06-13
suricata ET USER_AGENTS Go HTTP Client User-Agent rev 3 2024-06-13
snort ET WEB_SERVER Possible SQL injection WAITFOR DELAY in HTTP Request Body rev 1 2024-06-12
snort ET EXPLOIT Dahua DSS Security Management Platform Attempted Privilege Escalation rev 1 2024-06-12
snort ET EXPLOIT Telecommunications Gateway Configuration Management System Unauthenticated File Upload rev 1 2024-06-12
snort ET CURRENT_EVENTS Generic Survey Credential Phish Landing Page 2024-06-12 rev 1 2024-06-12
snort ET WEB_SERVER Possible SQL Injection WAITFOR DELAY in HTTP URI rev 1 2024-06-12
snort ET CURRENT_EVENTS Generic Survey Credential Phish Landing Page 2024-06-11 rev 1 2024-06-12