Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Win32/ProcessKiller Payload Retrieval Attempt rev 1 2024-04-24
snort ET TROJAN Win32/ProcessKiller CnC - Server Side rev 1 2024-04-24
snort ET TROJAN Win32/ProcessKiller CnC - Client Side rev 1 2024-04-24
suricata ET MALWARE [FIREEYE] PULSECHECK Webshell Access Outbound rev 2 2024-04-24
suricata ET MALWARE VoidRay Downloader CnC Activity rev 2 2024-04-24
suricata ET MALWARE SupremeLogger CnC Checkin rev 2 2024-04-24
suricata ET MALWARE SharpPanda APT Maldoc Activity rev 2 2024-04-24
suricata ET MALWARE Remote Desktop Spy Install Checkin rev 2 2024-04-24
suricata ET MALWARE ETag HTTP Header Observed at CNCERT Sinkhole rev 2 2024-04-24
suricata ET MALWARE Win32/ProcessKiller CnC - Client Side rev 1 2024-04-24
suricata ET MALWARE DonotGroup Template Download rev 2 2024-04-24
suricata ET MALWARE Cobalt Strike Beacon Activity rev 2 2024-04-24
suricata ET HUNTING Suspicious GET Request for .x64 rev 2 2024-04-24
suricata ET MALWARE MICROPSIA Screenshot Upload M2 rev 3 2024-04-24
suricata ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara4 Default X509 Certificate String rev 2 2024-04-24
suricata ET MALWARE Win32/Ymacco.AA1C Activity rev 2 2024-04-24
suricata ET MALWARE Win32/ProcessKiller Payload Retrieval Attempt rev 1 2024-04-24
suricata ET MALWARE Gamaredon MalDoc CnC Exfil rev 2 2024-04-24
suricata ET MALWARE Win32/ProcessKiller CnC Initialization M1 rev 1 2024-04-24
suricata ET MALWARE Generic - POST To .php w/Extended ASCII Characters rev 16 2024-04-24
suricata ET MALWARE Win32/ProcessKiller CnC - Server Side rev 1 2024-04-24
suricata ET HUNTING Terse Request for EXE from DigitalOcean Spaces rev 2 2024-04-24
suricata ET MALWARE Win32/MereTam.A Ransomware CnC Init Activity rev 2 2024-04-24
suricata ET MALWARE Snake Keylogger CnC Exfil via Telegram rev 2 2024-04-24
suricata ET ADWARE_PUP OSX/Adware.Pirrit CnC Activity 4 rev 2 2024-04-24
suricata ET HUNTING Suspicious GET Request for .x86 rev 2 2024-04-24
suricata ET MALWARE Kimsuky Maldoc Activity rev 2 2024-04-24
suricata ET MALWARE RedLine - GetArguments Request rev 2 2024-04-24
suricata ET MALWARE MSIL/NoCry Ransomware Checkin Via Discord rev 2 2024-04-24
suricata ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole rev 2 2024-04-24
suricata ET HUNTING Observed POST to xsph .ru Domain rev 2 2024-04-24
suricata ET ADWARE_PUP OSX/Adware.Pirrit CnC Activity 3 rev 2 2024-04-24
sigma JScript Compiler Execution test 2024-04-24
sigma Potential Application Whitelisting Bypass via Dnx.EXE test 2024-04-24
sigma Windows Kernel Debugger Execution test 2024-04-24
snort ET TROJAN APT Related CR4T Backdoor Activity rev 1 2024-04-23
sigma Use of FSharp Interpreters test 2024-04-23
sigma Potential Arbitrary Command Execution Via FTP.EXE test 2024-04-23
sigma Forest Blizzard APT - Custom Protocol Handler Creation test 2024-04-23
sigma Forest Blizzard APT - Custom Protocol Handler DLL Registry Set test 2024-04-23