Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN TransparentTribe CnC Domain in DNS Lookup rev 1 2022-03-08
snort ET TROJAN MSIL/BlackGuard Stealer Variant Exfil via Telegram rev 3 2022-03-08
snort ET TROJAN TransparentTribe CnC Domain in DNS Lookup rev 1 2022-03-08
sigma Writing Of Malicious Files To The Fonts Folder test 2022-03-08
sigma Invoke-Obfuscation Via Use MSHTA test 2022-03-08
snort ET TROJAN Ave Maria/Warzone RAT Encrypted CnC Checkin rev 2 2022-03-07
snort ET TROJAN SystemBC Powershell bot registration rev 2 2022-03-07
snort ET EXPLOIT Azure Automation Authentication Bypass rev 2 2022-03-07
snort ET TROJAN MSIL/BlackGuard Stealer Exfil Activity rev 1 2022-03-07
suricata ET EXPLOIT Azure Automation Authentication Bypass rev 2 2022-03-07
suricata ET MALWARE MSIL/BlackGuard Stealer Exfil Activity rev 1 2022-03-07
suricata ET MALWARE SystemBC Powershell bot registration rev 2 2022-03-07
suricata ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin rev 2 2022-03-07
snort ET TROJAN CobaltStrike DNS Beacon Response rev 8 2022-03-05
suricata ET MALWARE CobaltStrike DNS Beacon Response rev 9 2022-03-05
sigma Suspicious IO.FileStream test 2022-03-05
snort ET CURRENT_EVENTS Microsoft Credential Phish 2022-03-14 rev 1 2022-03-04
suricata ET PHISHING Microsoft Credential Phish 2022-03-14 rev 2 2022-03-04
snort ET TROJAN Win32/PlugX Related Domain in DNS Lookup rev 2 2022-03-03
snort ET TROJAN TA402/Molerats Related Domain in DNS Lookup rev 1 2022-03-03
snort ET TROJAN Win32/PurpleFox Related Domain in DNS Lookup rev 1 2022-03-03
snort ET TROJAN TA402/Molerats Related Domain in DNS Lookup rev 1 2022-03-03
sigma Powershell Detect Virtualization Environment test 2022-03-03
snort ET CURRENT_EVENTS Successful Generic Credential Phish 2022-03-02 rev 2 2022-03-02
snort ET CURRENT_EVENTS Successful Royal Bank of Canada Credential Phish 2022-03-02 rev 1 2022-03-02
snort ET TROJAN DangerousPassword APT Related Domain in DNS Lookup rev 1 2022-03-02
suricata ET PHISHING Successful Royal Bank of Canada Credential Phish 2022-03-02 rev 2 2022-03-02
suricata ET PHISHING Successful Generic Credential Phish 2022-03-02 rev 2 2022-03-02
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-03-01 rev 2 2022-03-01
snort ET TROJAN Win32/Backdoor.Daxin CnC Activity rev 2 2022-03-01
snort ET TROJAN Win32/Trickbot Data Exfiltration M2 rev 2 2022-03-01
snort ET TROJAN Win32/Trickbot Data Exfiltration M3 rev 2 2022-03-01
suricata ET JA3 Hash - Possible AnchorMail CnC Traffic rev 1 2022-03-01
suricata ET PHISHING Generic Credential Phish Landing Page 2022-03-01 rev 2 2022-03-01
sigma Suspicious PowerShell Download and Execute Pattern test 2022-03-01
snort ET INFO Chocolatey Windows Package Management Installation File Retrieval rev 1 2022-02-28
snort ET EXPLOIT Linux/Attempted Hosts File Exfil rev 2 2022-02-28
suricata ET MALWARE Win32/Agent.UHC CnC Activity rev 3 2022-02-28
snort ET POLICY Cisco IOS Self Signed Certificate Served to External Host rev 2 2022-02-26
snort ET POLICY Nessus Server SSL certificate detected rev 3 2022-02-26