Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Possible STEADYPULSE Webshell Accessed M2 rev 2 2021-04-21
snort ET INFO Observed DNS Query to DDNS Domain .myfirewall .org rev 1 2021-04-21
snort ET TROJAN 44 Caliber Stealer Data Exfil via Discord rev 2 2021-04-21
suricata ET INFO Observed DNS Query to DDNS Domain .myfirewall .org rev 1 2021-04-21
suricata ET MALWARE 44 Caliber Stealer Data Exfil via Discord rev 1 2021-04-21
snort ET TROJAN Cobalt Strike Stager Time Check M2 rev 1 2021-04-20
snort ET TROJAN Cobalt Strike Stager Time Check M1 rev 2 2021-04-20
snort ET TROJAN HabitsRAT Checkin rev 2 2021-04-20
snort ET TROJAN Magecart/Skimmer - _try_action Exfil Attempt rev 2 2021-04-20
snort ET TROJAN Possibly SLIGHTPULSE Related - Suspicious POST to Specific URI Path rev 2 2021-04-20
suricata ET MALWARE Possibly SLIGHTPULSE Related - Suspicious POST to Specific URI Path rev 1 2021-04-20
suricata ET MALWARE Cobalt Strike Stager Time Check M2 rev 1 2021-04-20
suricata ET MALWARE Magecart/Skimmer - _try_action Exfil Attempt rev 1 2021-04-20
suricata ET MALWARE Cobalt Strike Stager Time Check M1 rev 2 2021-04-20
snort ET TROJAN Gamaredon MalDoc CnC Exfil rev 2 2021-04-19
snort ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation - Responding with Superuser Credentials rev 2 2021-04-19
snort ET TROJAN Win32/Unk Downloader CnC Activity rev 3 2021-04-19
snort ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation Inbound M1 rev 2 2021-04-19
snort ET TROJAN Remcos Builder License Check rev 2 2021-04-19
snort ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation Inbound M2 rev 2 2021-04-19
suricata ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation Inbound M1 rev 1 2021-04-19
suricata ET EXPLOIT ZBL EPON ONU Broadband Router Remote Privilege Escalation Inbound M2 rev 1 2021-04-19
snort ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2021-04-16
snort ET TROJAN Remcos 3.x Unencrypted Server Response rev 2 2021-04-16
snort ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2021-04-16
snort ET TROJAN Remcos 3.x Unencrypted Checkin rev 2 2021-04-16
suricata ET MALWARE Remcos 3.x Unencrypted Checkin rev 2 2021-04-16
suricata ET MALWARE Remcos 3.x Unencrypted Server Response rev 2 2021-04-16
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2021-04-16
suricata ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2021-04-16
elastic SQL Traffic to the Internet deprecated 2021-04-15
elastic RDP (Remote Desktop Protocol) to the Internet deprecated 2021-04-15
elastic Potential Persistence via Cron Job deprecated 2021-04-15
elastic IRC (Internet Relay Chat) Protocol Activity to the Internet deprecated 2021-04-15
elastic FTP (File Transfer Protocol) Activity to the Internet deprecated 2021-04-15
elastic Process Discovery via Tasklist deprecated 2021-04-15
elastic PowerShell spawning Cmd deprecated 2021-04-15
elastic Mknod Process Activity deprecated 2021-04-15
elastic TCP Port 8000 Activity to the Internet deprecated 2021-04-15
elastic Socat Process Activity deprecated 2021-04-15