Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN PoshC2 - Observed Default URI Structure M25 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M22 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M13 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M9 rev 2 2022-05-06
snort ET INFO Trend Micro Phishing Simulation Service rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M30 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M31 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M15 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M27 rev 2 2022-05-06
snort ET MOBILE_MALWARE Observed Trojan-Spy.AndroidOS.Origami.b / Donot Domain in TLS SNI rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M20 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M5 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M16 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M32 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M24 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M28 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M29 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M26 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M6 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M16 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M19 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M23 rev 2 2022-05-06
suricata ET INFO Trend Micro Phishing Simulation Service rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M11 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M17 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M20 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M30 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M15 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M8 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M22 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M13 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M25 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M32 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M7 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M21 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M31 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M9 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M27 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M12 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M24 rev 2 2022-05-06