Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN RubySleet APT TrollAgent CnC Checkin rev 1 2024-02-02
suricata ET MALWARE RubySleet APT TrollAgent CnC Checkin rev 1 2024-02-02
sigma Potential Remote PowerShell Session Initiated test 2024-02-02
sigma Network Connection Initiated Via Notepad.EXE test 2024-02-02
sigma Communication To Ngrok Tunneling Service Initiated test 2024-02-02
snort ET TROJAN HTTP POST with Suspicious User-Agent Observed - Possible ZLoader Activity M1 rev 1 2024-01-31
snort ET INFO RustDesk Relay Domain in DNS Lookup rev 2 2024-01-31
snort ET EXPLOIT Online Scheduling System 1.0 - Authentication Bypass Attempt rev 3 2024-01-31
snort ET TROJAN CHAINLINE Web Shell Activity Observed rev 1 2024-01-31
snort ET TROJAN HTTP POST with Suspicious User-Agent Observed - Possible ZLoader Activity M2 rev 1 2024-01-31
snort ET INFO DYNAMIC_DNS Query to *.duckdns. Domain rev 4 2024-01-31
snort ET INFO DYNAMIC_DNS Query to *.dyndns. Domain rev 8 2024-01-31
snort ET INFO AhaDNS DNS Over HTTPS Certificate Inbound rev 3 2024-01-31
snort ET MALWARE Lookup of Malware Domain twothousands.cm Likely Infection rev 4 2024-01-31
snort ET DNS Query to a *.pw domain - Likely Hostile rev 6 2024-01-31
snort ET TROJAN FRAMEREST Web Shell Activity Observed rev 1 2024-01-31
snort ET TROJAN LIGHTWIRE Web Shell Activity Observed rev 1 2024-01-31
snort ET DNS Query to a .tk domain - Likely Hostile rev 5 2024-01-31
suricata ET PHISHING Generic Credential Phish Landing Page 2022-10-12 rev 2 2024-01-31
suricata ET PHISHING Generic Credential Phish Landing Page 2022-06-02 rev 2 2024-01-31
suricata ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M1 rev 2 2024-01-31
suricata ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M2 rev 2 2024-01-31
suricata ET MALWARE Aurora Stealer Admin Console In HTTP Response rev 2 2024-01-31
suricata ET PHISHING Facebook Credential Phish Landing Page M2 2022-05-27 rev 2 2024-01-31
suricata ET SCADA IEC-104 Clock Synchronization Command rev 2 2024-01-31
suricata ET MALWARE DCRAT Checkin via Telegram rev 2 2024-01-31
suricata ET PHISHING Successful ING Banking Credential Phish 2022-12-12 rev 2 2024-01-31
suricata ET PHISHING DHL Credential Phish Landing Page 2022-10-07 rev 2 2024-01-31
suricata ET MALWARE [ANY.RUN] Hydrochasma Fast Reverse Proxy M3 rev 2 2024-01-31
suricata ET MALWARE HTTP POST with Suspicious User-Agent Observed - Possible ZLoader Activity M1 rev 1 2024-01-31
suricata ET MALWARE LIGHTWIRE Web Shell Activity Observed rev 1 2024-01-31
suricata ET MALWARE HTTP POST with Suspicious User-Agent Observed - Possible ZLoader Activity M2 rev 1 2024-01-31
suricata ET PHISHING Generic Credential Phish Landing Page 2022-09-26 rev 2 2024-01-31
suricata ET MALWARE Win32/Packed.Themida.AAL Checkin rev 2 2024-01-31
suricata ET PHISHING ING Banking Credential Phish Landing Page 2022-12-12 rev 2 2024-01-31
suricata ET MALWARE CHAINLINE Web Shell Activity Observed rev 1 2024-01-31
sigma Dfsvc.EXE Initiated Network Connection Over Uncommon Port test 2024-01-31
sigma Remote CHM File Download/Execution Via HH.EXE test 2024-01-31
snort ET INFO DYNAMIC_DNS Query to 3322.net Domain *.6600.org rev 8 2024-01-30
snort ET DNS Query for Suspicious .pl.tf Domain rev 3 2024-01-30