Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET TROJAN Win32/Logger RAT CnC Checkin rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET INFO DYNAMIC_DNS Query to didns .ru Domain rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET CURRENT_EVENTS Successful Generic Credential Phish 2022-09-26 rev 1 2022-09-26
snort ET TROJAN Golang/Webbfustator DNS Tunneling Activity rev 2 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET INFO DYNAMIC_DNS Query to dynnamn .ru Domain rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET TROJAN Maldoc CnC Checkin rev 1 2022-09-26
snort ET TROJAN OSX/SHLAYER CnC Domain in DNS Lookup rev 1 2022-09-26
snort ET TROJAN Gamaredon APT Backdoor Related Activity rev 1 2022-09-26
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-09-26 rev 1 2022-09-26
suricata ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response M2 rev 1 2022-09-26
suricata ET MALWARE Golang/Webbfustator DNS Tunneling Activity rev 2 2022-09-26
suricata ET PHISHING Successful Generic Credential Phish 2022-09-26 rev 1 2022-09-26
suricata ET MALWARE Win32/Logger RAT CnC Checkin rev 1 2022-09-26
sigma Use of W32tm as Timer test 2022-09-25
snort ET INFO SSH-2.0-Go version string Observed in Network Traffic rev 1 2022-09-23
snort ET CURRENT_EVENTS Successful Credential Phish M2 2022-09-23 rev 1 2022-09-23
snort ET CURRENT_EVENTS Successful Credential Phish M1 2022-09-23 rev 1 2022-09-23
snort ET CURRENT_EVENTS Successful Credential Phish M3 2022-09-23 rev 1 2022-09-23
snort ET ATTACK_RESPONSE JS/Spy.Banker.LD Credit Card Skimmer Inbound rev 1 2022-09-23
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-09-23 rev 1 2022-09-23
snort ET INFO SSH-2.0-Go version string Observed in Network Traffic rev 1 2022-09-23
snort ET ATTACK_RESPONSE MalDoc/Generik.ILNMZZB Payload Inbound rev 1 2022-09-23
suricata ET PHISHING Generic Credential Phish Landing Page 2022-09-23 rev 1 2022-09-23
suricata ET INFO SSH-2.0-Go version string Observed in Network Traffic rev 1 2022-09-23
suricata ET ATTACK_RESPONSE MalDoc/Generik.ILNMZZB Payload Inbound rev 1 2022-09-23
suricata ET ATTACK_RESPONSE JS/Spy.Banker.LD Credit Card Skimmer Inbound rev 1 2022-09-23
suricata ET INFO SSH-2.0-Go version string Observed in Network Traffic rev 1 2022-09-23
suricata ET PHISHING Successful Credential Phish M3 2022-09-23 rev 1 2022-09-23
suricata ET PHISHING Successful Credential Phish M2 2022-09-23 rev 1 2022-09-23
suricata ET PHISHING Successful Credential Phish M1 2022-09-23 rev 1 2022-09-23
snort ET INFO Windows Commands and Variables in DNS Reply rev 1 2022-09-22