Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET ADWARE_PUP Win32/TrojanDownloader.Adload.NSD Variant Checkin rev 3 2024-03-25
suricata ET MALWARE ComRAT CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE BAZAR CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE MSIL/Azula Logger CnC Activity rev 3 2024-03-25
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.SSL.BEACON.[CSBundle Ajax] rev 3 2024-03-25
suricata ET INFO External IP Address Lookup via dawhois.com rev 5 2024-03-25
suricata ET MALWARE Observed DNS Query to Vicious Panda CnC Domain rev 3 2024-03-25
suricata ET MALWARE TA455 Related CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET ADWARE_PUP Win32/MobiGame Install Stats Checkin M1 rev 2 2024-03-25
suricata ET MALWARE Possible FoggyWeb Backdoor Server Response rev 3 2024-03-25
suricata ET MALWARE ComRAT CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Unknown Chinese Threat Actor CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Observed MageCart CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice POST] rev 4 2024-03-25
suricata ET ADWARE_PUP ThunderUnion Install Checkin rev 2 2024-03-25
suricata ET MALWARE ComRAT CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Query for Known Hostile *test.3322.org.cn Domain rev 2 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed DNS Query to Stitch C2 Domain rev 3 2024-03-25
suricata ET MALWARE GCleaner Downloader Activity M2 rev 2 2024-03-25
suricata ET MOBILE_MALWARE PHANTOMLANCE CnC Domain in DNS Lookup rev 3 2024-03-25
suricata ET MALWARE Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed DarkSide Ransomware CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Win32/Bisonal Backdoor CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE NSIS/TrojanDownloader.Agent.NZK CnC Activity M2 rev 3 2024-03-25
suricata ET MALWARE Win32/MysterySnail RAT CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Lunar Builder Exfil Response rev 3 2024-03-25
suricata ET MALWARE TA455 Related CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Suspected DonotGroup Dropper Activity rev 2 2024-03-25
suricata ET MALWARE Smanager CnC Domain in DNS Lookup rev 2 2024-03-25
suricata ET MALWARE Linux DarkRadiation Ransomware Activity Attack Check rev 2 2024-03-25
suricata ET EXPLOIT Possible Uniview IPC2322lb updatecpld Restricted Shell Bypass Attempt rev 1 2024-03-25
suricata ET MALWARE HabitsRAT Checkin rev 2 2024-03-25
suricata ET MALWARE Observed DNS Query to WHO Themed Malware Delivery Domain rev 3 2024-03-25
suricata ET INFO Unix/Linux Processhider Source Being Downloaded rev 2 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25