Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Observed Cobalt Strike Stager Domain in DNS Query rev 2 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 3 2024-03-24
suricata ET MALWARE Observed DCRat CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE EvilNum CnC Client Data Exfil rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE CommentCrew Possible APT backdoor download logo.png rev 7 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24
suricata ET INFO Observed DeepFreezeWeb User-Agent rev 2 2024-03-24
suricata ET ADWARE_PUP InstallCore PUA/Adware Activity M2 rev 5 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET MALWARE Observed VikroStealer CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Win32/Beapy CnC Domain in DNS Lookup rev 2 2024-03-24
suricata ET MALWARE Keyboy CN APT CnC Domain in DNS Lookup rev 3 2024-03-24
suricata ET MALWARE Observed APT/SideWinder CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed Ursnif Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET ADWARE_PUP InstallCore PUA/Adware Activity M3 rev 5 2024-03-24
suricata ET MALWARE FakeAV User-Agent XML rev 5 2024-03-24
suricata ET MALWARE Observed DNS Query to Ursnif SAIGON Variant CnC Domain rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE XcodeGhost CnC Checkin rev 4 2024-03-24
snort ET MOBILE_MALWARE Trojan-Dropper.AndroidOS.Anatsa Checkin rev 2 2024-03-22
sigma Potential KamiKakaBot Activity - Lure Document Execution test 2024-03-22
sigma Potential KamiKakaBot Activity - Shutdown Schedule Task Creation test 2024-03-22
sigma Potential KamiKakaBot Activity - Winlogon Shell Persistence test 2024-03-22
sigma Suspicious DNS Query for IP Lookup Service APIs test 2024-03-22
sigma Suspicious Network Connection to IP Lookup Service APIs test 2024-03-22
snort ET MOBILE_MALWARE Android Vultr Checkin rev 2 2024-03-21
snort ET TROJAN TA402/Molerats CnC Activity rev 2 2024-03-21
snort ET TROJAN Possible HijackLoader Second Stage PNG Retrieval rev 1 2024-03-21
suricata ET MALWARE Possible HijackLoader Second Stage PNG Retrieval rev 1 2024-03-21
snort ET TROJAN Win32/IDAT Loader Related Activity rev 1 2024-03-20
suricata ET MALWARE Suspected Agent Racoon Backdoor DNS Related Activity rev 1 2024-03-20
sigma CVE-2024-1212 Exploitation - Progress Kemp LoadMaster Unauthenticated Command Injection test 2024-03-20
sigma FlowCloud Registry Markers test 2024-03-20
sigma MaxMpxCt Registry Value Changed test 2024-03-19