Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Observed CobInt CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE EvilNum CnC Client Data Exfil rev 2 2024-03-24
suricata ET MALWARE Observed Cobalt Strike Stager Domain in DNS Query rev 2 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 3 2024-03-24
suricata ET MALWARE EvilNum CnC Client Data Exfil rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed DCRat CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET ADWARE_PUP W32/OnlineGames Checkin rev 7 2024-03-24
suricata ET MALWARE FakeAV User-Agent XML rev 5 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE W32/Numnet.Downloader CnC Checkin 1 rev 4 2024-03-24
suricata ET INFO Internal Host Retrieving External IP via myip.dnsomatic.com rev 5 2024-03-24
suricata ET WEB_SPECIFIC_APPS Attempted Symantec Secure Web Gateway RCE rev 2 2024-03-24
suricata ET MALWARE MuddyWater Payload - CnC Checkin rev 2 2024-03-24
suricata ET ADWARE_PUP InstallCore PUA/Adware Activity M4 rev 5 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET ADWARE_PUP InstallCore PUA/Adware Activity M2 rev 5 2024-03-24
suricata ET EXPLOIT Attempted Netgear Buffer Overflow into RCE Inbound M1 rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 2 2024-03-24
suricata ET MALWARE Win32/Beapy CnC Domain in DNS Lookup rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET USER_AGENTS User-agent DownloadNetFile Win32.small.hsh downloader rev 16 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET INFO Observed DeepFreezeWeb User-Agent rev 2 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET MALWARE CommentCrew Possible APT backdoor download logo.png rev 7 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 3 2024-03-24