Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET ATTACK_RESPONSE UTF16-LE base64 wide string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET ATTACK_RESPONSE UTF16 base64 reversed string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET ATTACK_RESPONSE UTF16 base64 reversed string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M7 rev 1 2023-01-24
snort ET ATTACK_RESPONSE UTF16-LE base64 wide string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M4 rev 1 2023-01-24
snort ET ATTACK_RESPONSE UTF16-LE base64 string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET ATTACK_RESPONSE UTF8 base64 reversed string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M3 rev 1 2023-01-24
snort ET ATTACK_RESPONSE UTF16-LE base64 wide string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET ATTACK_RESPONSE UTF8 base64 string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET ATTACK_RESPONSE UTF8 base64 reversed string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M2 rev 1 2023-01-24
snort ET TROJAN SLIVER Framework SMB CreateService Default ServiceName rev 1 2023-01-24
snort ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M8 rev 1 2023-01-24
snort ET ATTACK_RESPONSE UTF8 base64 wide string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET ATTACK_RESPONSE UTF8 base64 string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET ATTACK_RESPONSE UTF16-LE base64 string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M6 rev 1 2023-01-24
snort ET ATTACK_RESPONSE UTF16-LE base64 string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET ATTACK_RESPONSE UTF16 base64 reversed string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET ATTACK_RESPONSE UTF8 base64 reversed string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET ATTACK_RESPONSE UTF8 base64 string /This Program/ in DNS TXT Reponse rev 2 2023-01-24
snort ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M9 rev 1 2023-01-24
snort ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M5 rev 1 2023-01-24
suricata ET ATTACK_RESPONSE UTF16-LE base64 string /This Program/ in DNS TXT Reponse rev 3 2023-01-24
suricata ET MALWARE Win32/Obsidium Stealer Data Exfiltration Attempt M9 rev 1 2023-01-24
suricata ET MALWARE Win32/Obsidium Stealer Data Exfiltration Attempt M5 rev 1 2023-01-24
suricata ET MALWARE Win32/Obsidium Stealer Data Exfiltration Attempt M3 rev 1 2023-01-24
suricata ET ATTACK_RESPONSE UTF8 base64 wide string /This Program/ in DNS TXT Reponse rev 3 2023-01-24
suricata ET MALWARE Win32/Obsidium Stealer Data Exfiltration Attempt M1 rev 1 2023-01-24
suricata ET ATTACK_RESPONSE UTF16-LE base64 wide string /This Program/ in DNS TXT Reponse rev 3 2023-01-24
suricata ET ATTACK_RESPONSE UTF8 base64 string /This Program/ in DNS TXT Reponse rev 3 2023-01-24
suricata ET ATTACK_RESPONSE UTF16 base64 reversed string /This Program/ in DNS TXT Reponse rev 3 2023-01-24
suricata ET ATTACK_RESPONSE UTF16 base64 reversed string /This Program/ in DNS TXT Reponse rev 3 2023-01-24
suricata ET ATTACK_RESPONSE UTF16-LE base64 string /This Program/ in DNS TXT Reponse rev 3 2023-01-24
suricata ET MALWARE Win32/Obsidium Stealer Data Exfiltration Attempt M8 rev 1 2023-01-24
suricata ET MALWARE Win32/Obsidium Stealer Data Exfiltration Attempt M7 rev 1 2023-01-24
suricata ET ATTACK_RESPONSE UTF16-LE base64 wide string /This Program/ in DNS TXT Reponse rev 3 2023-01-24
suricata ET ATTACK_RESPONSE UTF16-LE base64 string /This Program/ in DNS TXT Reponse rev 3 2023-01-24