Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET INFO Request to .GA Domain with Minimal Headers rev 3 2024-04-05
snort ET INFO Request to 000webhostapp Domain with Minimal Headers rev 3 2024-04-05
snort ET TROJAN Suspected Parallax RAT Checkin rev 1 2024-04-05
snort ET INFO Request to .TOP Domain with Minimal Headers rev 3 2024-04-05
snort ET INFO Request to .TK Domain with Minimal Headers rev 3 2024-04-05
snort ET INFO Request to .ML Domain with Minimal Headers rev 3 2024-04-05
snort ET INFO Request to .XYZ Domain with Minimal Headers rev 3 2024-04-05
snort ET INFO Request to .CF Domain with Minimal Headers rev 3 2024-04-05
snort ET INFO Request to .GQ Domain with Minimal Headers rev 3 2024-04-05
suricata ET INFO Dotted Quad Host XLSX Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host DOCX Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host PPTX Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host PPT Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host DOC Request rev 7 2024-04-05
suricata ET HUNTING Suspicious POST Format rev 3 2024-04-05
suricata ET INFO Dotted Quad Host HTA Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host PS Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host PDF Request rev 7 2024-04-05
suricata ET INFO Dotted Quad Host ZIP Request rev 6 2024-04-05
suricata ET MALWARE Octopus Malware CnC Activity rev 3 2024-04-05
suricata ET MALWARE Suspected Parallax RAT Checkin rev 1 2024-04-05
suricata ET INFO Dotted Quad Host XLS Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host VBS Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host RAR Request rev 6 2024-04-05
suricata ET MALWARE [PTsecurity] Win32/Spy.RTM/Redaman IP Check rev 6 2024-04-05
suricata ET INFO Dotted Quad Host GZ Request rev 6 2024-04-05
suricata ET INFO Dotted Quad Host DLL Request rev 6 2024-04-05
suricata ET MALWARE Hades APT Downloader Attempting to Retrieve Stage 2 Payload rev 4 2024-04-05
suricata ET HUNTING Suspicious POST Format rev 3 2024-04-05
suricata ET INFO Chocolatey Windows Package Management Installation File Retrieval rev 3 2024-04-05
suricata ET INFO Dotted Quad Host RTF Request rev 6 2024-04-05
suricata ET INFO Minimal HTTP GET Request to Bit.ly rev 4 2024-04-05
suricata ET MALWARE Possible Sharik/Smoke Loader 7zip Connectivity Check rev 4 2024-04-05
suricata ET INFO Dotted Quad Host TGZ Request rev 6 2024-04-05
sigma Invoke-Obfuscation Via Stdin - Powershell test 2024-04-05
sigma Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module test 2024-04-05
sigma Invoke-Obfuscation VAR+ Launcher - PowerShell Module test 2024-04-05
sigma Invoke-Obfuscation STDIN+ Launcher - PowerShell Module test 2024-04-05
sigma Invoke-Obfuscation Via Use Clip - PowerShell Module test 2024-04-05
sigma Invoke-Obfuscation CLIP+ Launcher - PowerShell Module test 2024-04-05