Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET INFO DYNAMIC_DNS HTTP Request to a *.toythieves .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.mypop3 .org Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.dynssl .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.mynetav .net Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.2waky .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.edns .biz Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.mynetav .org Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.dubya .net Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.youdontcare .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.serveuser .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.wikaba .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.americanunfinished .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.mrface .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.dubya .us Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.mrbonus .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.mydad .info Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.dnsfailover .net Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.squirly .info Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.ninth .biz Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS HTTP Request to a *.onedumb .com Domain rev 2 2022-04-14
snort ET INFO DYNAMIC_DNS Query to a *.mynetav .net Domain rev 2 2022-04-14
suricata ET MALWARE Lyceum Golang HTTP Backdoor Submitting Data to CnC rev 1 2022-04-14
suricata ET MALWARE Fodcha Bot CnC Client Heartbeat rev 2 2022-04-14
suricata ET MALWARE Lyceum Golang HTTP Backdoor Requesting Commands rev 1 2022-04-14
suricata ET MALWARE Fodcha Bot CnC Heartbeat Response rev 2 2022-04-14
suricata ET MALWARE Lyceum Golang HTTP Backdoor CnC Checkin rev 1 2022-04-14
sigma Arbitrary Shell Command Execution Via Settingcontent-Ms test 2022-04-14
snort ET CURRENT_EVENTS Sparkasse Credential Phish Landing Page M1 2022-04-13 rev 1 2022-04-13
snort ET CURRENT_EVENTS Successful Sparkasse Credential Phish M1 2022-04-13 rev 1 2022-04-13
snort ET POLICY SMB NT Create AndX Request For an Executable File In a Temp Directory rev 3 2022-04-13
snort ET TROJAN VBS/Agent.PUK Data Exfiltration Request M2 rev 1 2022-04-13
snort ET CURRENT_EVENTS Sparkasse Credential Phish Landing Page M4 2022-04-13 rev 1 2022-04-13
snort ET ATTACK_RESPONSE FTP CWD to windows system32 - Suspicious rev 8 2022-04-13
snort ET CURRENT_EVENTS Successful Sparkasse Credential Phish M2 2022-04-13 rev 1 2022-04-13
snort ET MOBILE_MALWARE Observed Trojan-Spy.AndroidOS.Agent.abe Domain in TLS SNI rev 2 2022-04-13
snort ET TROJAN VBS/Agent.PUK Data Exfiltration Request M1 rev 1 2022-04-13
suricata ET PHISHING Sparkasse Credential Phish Landing Page M1 2022-04-13 rev 2 2022-04-13
suricata ET MALWARE VBS/Agent.PUK Data Exfiltration Request M2 rev 1 2022-04-13
suricata ET MALWARE VBS/Agent.PUK Data Exfiltration Request M1 rev 1 2022-04-13
suricata ET HUNTING FTP CWD to windows system32 - Suspicious rev 7 2022-04-13