Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE DNSChanger CnC Domain in DNS Lookup rev 5 2024-03-25
suricata ET ADWARE_PUP Observed DNS Query to Malvertising Related Domain rev 3 2024-03-25
sigma Disable Windows Event Logging Via Registry test 2024-03-25
sigma Service Binary in User Controlled Folder test 2024-03-25
sigma CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry test 2024-03-25
sigma Potential CobaltStrike Service Installations - Registry test 2024-03-25
sigma Change Winevt Channel Access Permission Via Registry test 2024-03-25
sigma Windows Defender Service Disabled - Registry test 2024-03-25
sigma Disable Microsoft Defender Firewall via Registry test 2024-03-25
sigma Disable Administrative Share Creation at Startup test 2024-03-25
sigma Default RDP Port Changed to Non Standard Port test 2024-03-25
sigma Sysmon Driver Altitude Change test 2024-03-25
sigma New PortProxy Registry Entry Added test 2024-03-25
sigma Add Port Monitor Persistence in Registry test 2024-03-25
sigma Run Once Task Configuration in Registry test 2024-03-25
suricata ET MALWARE W32/Numnet.Downloader CnC Checkin 1 rev 4 2024-03-24
suricata ET INFO Dell MyWay Remote control agent rev 7 2024-03-24
suricata ET MALWARE FakeAV User-Agent XML rev 5 2024-03-24
suricata ET INFO Internal Host Retrieving External IP via myip.dnsomatic.com rev 5 2024-03-24
suricata ET ADWARE_PUP InstallCore PUA/Adware Activity M4 rev 5 2024-03-24
suricata ET ADWARE_PUP InstallCore PUA/Adware Activity M2 rev 5 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET MALWARE Observed Ursnif Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Possible W32/KanKan Update officeaddinupdate.xml Request rev 5 2024-03-24
suricata ET MALWARE Win32/Beapy CnC Domain in DNS Lookup rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Hisoka CnC Domain Observed in DNS Query rev 2 2024-03-24
suricata ET MALWARE Sofacy HTTP Request microsof-update.com rev 3 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 3 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 3 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24