Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE IIStealer Inbound Exfil Request M2 rev 3 2024-04-30
suricata ET MALWARE PlugX/Korplug CnC Activity rev 3 2024-04-30
suricata ET MALWARE [ANY.RUN] LgoogLoader Retrieving Config File rev 3 2024-04-30
suricata ET MALWARE PWS.Win32/Daceluw.A Checkin rev 6 2024-04-30
suricata ET MALWARE Possible Babar POST Request rev 5 2024-04-30
suricata ET MALWARE ReflectiveGnome Download Activity rev 4 2024-04-30
suricata ET MALWARE Win32/BLUELIGHT OAuth Login Attempt rev 3 2024-04-30
suricata ET MALWARE Ransomware Win32/WinPlock.A CnC Beacon 3 rev 7 2024-04-30
suricata ET HUNTING Suspicious Terse Request for .pif rev 3 2024-04-30
suricata ET MALWARE Moose CnC Request M1 rev 7 2024-04-30
suricata ET INFO NSecSoft Remote Monitoring Update/Download Activity M1 rev 3 2024-04-30
suricata ET MALWARE Win64/Agent.BP System Info Exfil rev 3 2024-04-30
suricata ET MALWARE X-Files Stealer CnC Exfil Activity M2 rev 3 2024-04-30
suricata ET HUNTING Request to .TK Domain with Minimal Headers rev 4 2024-04-30
suricata ET HUNTING Request to 000webhostapp Domain with Minimal Headers rev 4 2024-04-30
suricata ET MALWARE TA450 Nagual CnC Activity rev 3 2024-04-30
suricata ET MALWARE [FIREEYE] SLIGHTPULSE Webshell Activity M2 rev 3 2024-04-30
suricata ET MALWARE TeleBots BCS-server CnC Beacon rev 5 2024-04-30
suricata ET MALWARE Observed Buran Ransomware UA rev 4 2024-04-30
suricata ET HUNTING Request to .ML Domain with Minimal Headers rev 4 2024-04-30
suricata ET MALWARE W32/Threebyte.APT Checkin rev 5 2024-04-30
suricata ET EXPLOIT Possible Google Cookie Token Manipulation Activity rev 3 2024-04-30
suricata ET EXPLOIT_KIT RIG Payload URI Struct March 20 2015 rev 5 2024-04-30
suricata ET MALWARE [ANY.RUN] Win32/RootTeam Stealer CnC Exfil M3 rev 4 2024-04-30
suricata ET MOBILE_MALWARE Android/SlemBunk.Banker Phished Credentials Upload rev 5 2024-04-30
suricata ET MALWARE Win32/RecordBreaker - Library Request rev 3 2024-04-30
suricata ET MALWARE EVILNUM CnC Connectivity Check rev 4 2024-04-30
suricata ET MALWARE Likely Arid Viper APT Advtravel Campaign POST rev 8 2024-04-30
suricata ET MALWARE Win32/BLUELIGHT OAuth Login Attempt M2 rev 4 2024-04-30
suricata ET MALWARE BluStealer - SysInfo Exfil via Telegram M2 rev 3 2024-04-30
suricata ET MALWARE KPOT Stealer Initial CnC Activity M5 rev 3 2024-04-30
suricata ET MALWARE Win32/Ymacco.AA67 CnC Activity rev 3 2024-04-30
suricata ET MALWARE Win32/TrojanProxy.JpiProx.B CnC Beacon 1 rev 5 2024-04-30
suricata ET ADWARE_PUP SecureDriverUpdater Checkin rev 4 2024-04-30
suricata ET MALWARE AgentTesla PWS HTTP CnC Checkin rev 7 2024-04-30
suricata ET ADWARE_PUP CoinSurf Proxy Client Registration rev 3 2024-04-30
suricata ET MALWARE Win32/RecordBreaker - Observed UA M1 rev 3 2024-04-30
suricata ET MALWARE WildPressure/Milum CnC Activity rev 4 2024-04-30
suricata ET ADWARE_PUP Win32 Handy Cafe Checkin rev 3 2024-04-30
suricata ET ADWARE_PUP [PTsecurity] Adware.FileFinder Activity rev 6 2024-04-30