Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN DNS query for Morto RDP worm related domain qfsl.net rev 4 2024-05-08
suricata ET INFO DNS Query for try2check.me Carder Tool rev 8 2024-05-08
suricata ET MALWARE DNS Query Sykipot Domain insdet.com rev 6 2024-05-08
suricata ET MALWARE DNS Query Sykipot Domain rusview.net rev 6 2024-05-08
suricata ET INFO tor4u tor2web .onion Proxy DNS lookup rev 6 2024-05-08
suricata ET MALWARE DNS query for Morto RDP worm related domain jaifr.com rev 7 2024-05-08
suricata ET MALWARE DNS query for Morto RDP worm related domain qfsl.net rev 7 2024-05-08
suricata ET MALWARE DNS query for Morto RDP worm related domain jifr.info rev 7 2024-05-08
suricata ET MALWARE Suspicious Accept-Language HTTP Header zh-cn likely Kernelbot/Conficker Trojan Related rev 11 2024-05-07
suricata ET SCAN Tomcat admin-blank login credentials rev 11 2024-05-07
suricata ET MALWARE Conficker/MS08-067 Worm Traffic Outbound rev 12 2024-05-07
suricata ET HUNTING Suspicious Empty User-Agent rev 27 2024-05-07
suricata ET ADWARE_PUP ZenoSearch Spyware User-Agent rev 16 2024-05-07
suricata ET SCAN Tomcat admin-admin login credentials rev 13 2024-05-07
suricata ET SCAN DEBUG Method Request with Command rev 7 2024-05-07
snort ET TROJAN Observed TA453 Domain in TLS SNI rev 1 2024-05-06
snort ET TROJAN Observed TA453 Domain in TLS SNI rev 1 2024-05-06
snort ET TROJAN Observed TA453 Related Domain in TLS SNI rev 1 2024-05-06
snort ET TROJAN BunnyLoader 3.0 Initial Checkin rev 2 2024-05-06
snort ET TROJAN TA453 Related Domain in DNS Lookup rev 1 2024-05-06
snort ET TROJAN DNS Query to TA453 Domain rev 1 2024-05-06
snort ET TROJAN DNS Query to TA453 Domain rev 1 2024-05-06
suricata ET MALWARE DNS Query to TA453 Domain rev 1 2024-05-06
suricata ET MALWARE Observed TA453 Domain in TLS SNI rev 1 2024-05-06
suricata ET MALWARE Known Sinkhole Response Header rev 6 2024-05-06
suricata ET MALWARE Observed TA453 Domain in TLS SNI rev 1 2024-05-06
suricata ET HUNTING EXE Download With Content Type Specified As Empty rev 8 2024-05-06
suricata ET WEB_SPECIFIC_APPS Plogger phpThumb.php w Parameter Remote File Disclosure Attempt rev 7 2024-05-06
suricata ET COINMINER Bitcoin Mining Extensions Header rev 7 2024-05-06
suricata ET MALWARE Observed TA453 Related Domain in TLS SNI rev 1 2024-05-06
suricata ET HUNTING Suspicious Invalid HTTP Accept Header of ? rev 6 2024-05-06
suricata ET INFO StumbleUpon Submission Detected rev 6 2024-05-06
suricata ET HUNTING SUSPICIOUS *.pdf.exe in HTTP HEADER rev 12 2024-05-06
suricata ET MALWARE TA453 Related Domain in DNS Lookup rev 1 2024-05-06
suricata ET INFO Akamai NetSession Interface PUTing data rev 4 2024-05-06
suricata ET WEB_SPECIFIC_APPS PithCMS oldnews_reader.php lang Parameter Local File Inclusion Attempt rev 6 2024-05-06
suricata ET MALWARE Trojan.MyDNS DNSChanger - HTTP POST rev 9 2024-05-06
suricata ET MALWARE UPDATE Protocol Trojan Communication detected on http ports 2 rev 7 2024-05-06
suricata ET HUNTING SUSPICIOUS *.doc.exe in HTTP HEADER rev 13 2024-05-06
suricata ET MALWARE AntiVirus exe Download Likely FakeAV Install rev 10 2024-05-06