Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE MSIL/Azula Logger CnC Activity rev 3 2024-03-25
suricata ET MALWARE ComRAT CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MOBILE_MALWARE Phenakite Image Upload CnC activity rev 2 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed TaurusStealer CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE PoetRAT CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET WEB_SERVER Babydraco WebShell Activity rev 2 2024-03-25
suricata ET MALWARE TA455 Related CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Observed OSX/Silver Sparrow Download Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE MAZE Ransomware Payment Domain DNS Lookup rev 3 2024-03-25
suricata ET INFO External IP Address Lookup via dawhois.com rev 5 2024-03-25
suricata ET MALWARE Observed DNS Query to Vicious Panda CnC Domain rev 3 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE ComRAT CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Lemon_Duck CnC Activity rev 2 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE ThiefQuest CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Win32/Sabsik.FL.B!ml CnC Activity rev 2 2024-03-25
suricata ET MALWARE APT/Bitter Related CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE W32/BlackEnergy Dirconf CnC Beacon rev 5 2024-03-25
suricata ET MALWARE BAZAR CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET EXPLOIT Ubiquiti Networks UniFi Cloud Key Firm v0.6.1 Host Remote Command Execution attempt rev 5 2024-03-25
suricata ET EXPLOIT Possible Uniview IPC2322lb updatecpld Restricted Shell Bypass Attempt rev 1 2024-03-25
suricata ET MALWARE Kimsuky APT CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Kimsuky APT CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE FakeAvCn-A Checkin 1 rev 6 2024-03-25
suricata ET MALWARE RedDelta Poison Ivy Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE GCleaner Downloader Activity M4 rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE OSX/MapperState CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Observed DNS Query to WHO Themed Malware Delivery Domain rev 3 2024-03-25
suricata ET MOBILE_MALWARE PHANTOMLANCE CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE MAZE Ransomware Payment Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Maldoc CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE ComRAT CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE RedDelta Poison Ivy Domain in DNS Lookup rev 3 2024-03-25