Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2020-12-17
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2020-12-17
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2020-12-16
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2020-12-16
suricata ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2020-12-16
snort ET TROJAN Dark Halo/SUNBURST Related DNS Lookup to webcodez .com rev 2 2020-12-15
snort ET TROJAN Dark Halo/SUNBURST Related DNS Lookup to solartrackingsystem .net rev 2 2020-12-15
snort ET MALWARE Windows Explorer Tab Add-on Post Install Checkin rev 2 2020-12-15
snort ET TROJAN [Fireeye] Backdoor.SUNBURST HTTP Request to avsvmcloud .com rev 3 2020-12-15
snort ET TROJAN Dark Halo/SUNBURST Related DNS Lookup to globalnetworkissues .com rev 2 2020-12-15
snort ET TROJAN Dark Halo/SUNBURST Related DNS Lookup to kubecloud .com rev 2 2020-12-15
snort ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to avsvmcloud .com rev 3 2020-12-15
snort ET TROJAN Dark Halo/SUNBURST Related DNS Lookup to seobundlekit .com rev 2 2020-12-15
snort ET TROJAN Dark Halo/SUNBURST Related DNS Lookup to lcomputers .com rev 2 2020-12-15
suricata ET MALWARE Dark Halo/SUNBURST Related DNS Lookup to lcomputers .com rev 1 2020-12-15
suricata ET MALWARE Dark Halo/SUNBURST Related DNS Lookup to kubecloud .com rev 1 2020-12-15
suricata ET MALWARE Dark Halo/SUNBURST Related DNS Lookup to seobundlekit .com rev 1 2020-12-15
suricata ET MALWARE Dark Halo/SUNBURST Related DNS Lookup to globalnetworkissues .com rev 1 2020-12-15
suricata ET MALWARE Dark Halo/SUNBURST Related DNS Lookup to solartrackingsystem .net rev 1 2020-12-15
snort ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to panhardware .com rev 2 2020-12-14
snort ET TROJAN [Fireeye] Observed SUNBURST DGA Request rev 2 2020-12-14
snort ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to deftsecurity .com rev 2 2020-12-14
snort ET TROJAN [Fireeye] Backdoor.SUNBURST M4 rev 2 2020-12-14
snort ET TROJAN [Fireeye] Backdoor.SUNBURST HTTP Request to digitalcollege .org rev 2 2020-12-14
snort ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to zupertech .com rev 2 2020-12-14
snort ET TROJAN [Fireeye] Backdoor.SUNBURST HTTP Request to virtualdataserver .com rev 2 2020-12-14
snort ET TROJAN [Fireeye] Backdoor.SUNBURST HTTP Request to thedoccloud .com rev 2 2020-12-14
snort ET TROJAN [Fireeye] Backdoor.BEACON M4 rev 2 2020-12-14
snort ET TROJAN [Fireeye] Backdoor.SUNBURST M3 rev 2 2020-12-14