Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE NS SSL Cert APT1 rev 4 2022-03-21
suricata ET MALWARE FAKE YAHOO SSL Cert APT1 rev 4 2022-03-21
suricata ET MALWARE FAKE AOL SSL Cert APT1 rev 4 2022-03-21
suricata ET MALWARE LAME SSL Cert APT1 rev 4 2022-03-21
sigma Serpent Backdoor Payload Execution Via Scheduled Task test 2022-03-21
snort ET TROJAN OSX/Proton.B Domain in SNI rev 3 2022-03-18
snort ET TROJAN Linux/B1txor20 Backdoor DNS Tunnel Activity M3 rev 2 2022-03-18
snort ET TROJAN Linux/B1txor20 Backdoor Connectivity Check rev 2 2022-03-18
snort ET TROJAN Linux/B1txor20 Backdoor DNS Tunnel Activity M1 rev 2 2022-03-18
snort ET TROJAN Linux/B1txor20 Backdoor DNS Tunnel Activity M2 rev 2 2022-03-18
snort ET TROJAN Bitter APT Backdoor Related Activity rev 1 2022-03-18
suricata ET MALWARE Linux/B1txor20 Backdoor DNS Tunnel Activity M1 rev 2 2022-03-18
suricata ET PHISHING Generic Credential Phish 2022-03-18 rev 2 2022-03-18
suricata ET MALWARE Bitter APT Backdoor Related Activity rev 1 2022-03-18
suricata ET MALWARE EMAIL SSL Cert APT1 rev 4 2022-03-18
suricata ET MALWARE Linux/B1txor20 Backdoor DNS Tunnel Activity M2 rev 2 2022-03-18
suricata ET MALWARE Linux/B1txor20 Backdoor Connectivity Check rev 2 2022-03-18
suricata ET MALWARE Linux/B1txor20 Backdoor DNS Tunnel Activity M3 rev 2 2022-03-18
snort ET TROJAN Loki Locker Ransomware CnC Domain in DNS Lookup rev 1 2022-03-17
snort ET TROJAN Sidewinder APT Related Domain in DNS Lookup rev 2 2022-03-17
snort ET CURRENT_EVENTS DHL Phish Landing Sept 14 2015 rev 4 2022-03-17
snort ET INFO PE EXE Download over raw TCP rev 3 2022-03-17
snort ET TROJAN Loki Locker Ransomware CnC Activity rev 2 2022-03-17
snort ET MALWARE Loki Locker Ransomware User-Agent rev 1 2022-03-17
snort ET MOBILE_MALWARE Android.Trojan.AndroRAT.CE Checkin rev 1 2022-03-17
suricata ET MALWARE Win32/Comrerop Checkin to FTP server rev 5 2022-03-17
suricata ET HUNTING PE EXE Download over raw TCP rev 3 2022-03-17
suricata ET MALWARE Perfect Keylogger Install Email Report rev 10 2022-03-17
suricata ET MALWARE Windows net start Microsoft Windows DOS prompt command exit OUTBOUND rev 2 2022-03-17
suricata ET MALWARE DoS.Linux/Elknot.G Checkin rev 2 2022-03-17
suricata ET MALWARE Loki Locker Ransomware User-Agent rev 1 2022-03-17
suricata ET SCAN Nmap NSE Heartbleed Request rev 2 2022-03-17
suricata ET MALWARE Windows ipconfig Microsoft Windows DOS prompt command exit OUTBOUND rev 4 2022-03-17
sigma Powershell Directory Enumeration test 2022-03-17
sigma Get-ADUser Enumeration Using UserAccountControl Flags test 2022-03-17
sigma Use Of Remove-Item to Delete File - ScriptBlock test 2022-03-17
sigma Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy test 2022-03-17
sigma Suspicious Process Discovery With Get-Process test 2022-03-17
snort ET POLICY Remote Desktop AeroAdmin handshake rev 2 2022-03-16
snort ET INFO ZIP file download over raw TCP rev 2 2022-03-16