Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN [Fireeye] Backdoor.SUNBURST M3 rev 2 2020-12-14
snort ET TROJAN [Fireeye] Backdoor.SUNBURST M2 rev 2 2020-12-14
snort ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to incomeupdate .com rev 2 2020-12-14
snort ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to deftsecurity .com rev 2 2020-12-14
snort ET TROJAN [Fireeye] Observed SUNBURST DGA Request rev 2 2020-12-14
snort ET TROJAN [Fireeye] Backdoor.SUNBURST HTTP Request to digitalcollege .org rev 2 2020-12-14
snort ET TROJAN [Fireeye] Backdoor.SUNBURST HTTP Request to deftsecurity .com rev 2 2020-12-14
snort ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to panhardware .com rev 2 2020-12-14
snort ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to thedoccloud .com rev 2 2020-12-14
snort ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to freescanonline .com rev 2 2020-12-14
snort ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to zupertech .com rev 2 2020-12-14
snort ET TROJAN [Fireeye] Backdoor.SUNBURST HTTP Request to virtualdataserver .com rev 2 2020-12-14
snort ET TROJAN [Fireeye] Backdoor.BEACON M6 rev 2 2020-12-14
snort ET TROJAN [Fireeye] SUNBURST Related DNS Lookup to digitalcollege .org rev 2 2020-12-14
snort ET TROJAN [Fireeye] Backdoor.BEACON M3 rev 2 2020-12-14
snort ET TROJAN [Fireeye] Backdoor.SUNBURST HTTP Request to freescanonline .com rev 2 2020-12-14
suricata ET MALWARE [Fireeye] Backdoor.SUNBURST HTTP Request to virtualdataserver .com rev 2 2020-12-14
suricata ET MALWARE [Fireeye] Backdoor.SUNBURST HTTP Request to freescanonline .com rev 2 2020-12-14
suricata ET MALWARE [Fireeye] SUNBURST Related DNS Lookup to deftsecurity .com rev 2 2020-12-14
suricata ET MALWARE [Fireeye] Backdoor.SUNBURST HTTP Request to thedoccloud .com rev 2 2020-12-14
suricata ET MALWARE [Fireeye] Backdoor.SUNBURST M4 rev 2 2020-12-14
suricata ET MALWARE [Fireeye] Backdoor.SUNBURST M1 rev 2 2020-12-14
suricata ET MALWARE [Fireeye] Backdoor.SUNBURST HTTP Request to deftsecurity .com rev 2 2020-12-14
suricata ET MALWARE IP Grabber CnC Activity rev 3 2020-12-14
suricata ET MALWARE [Fireeye] SUNBURST Related DNS Lookup to databasegalore .com rev 2 2020-12-14
suricata ET MALWARE [Fireeye] SUNBURST Related DNS Lookup to digitalcollege .org rev 2 2020-12-14
suricata ET MALWARE [Fireeye] SUNBURST Related DNS Lookup to thedoccloud .com rev 2 2020-12-14
suricata ET MALWARE [Fireeye] SUNBURST Related DNS Lookup to freescanonline .com rev 2 2020-12-14
suricata ET MALWARE [Fireeye] SUNBURST Related DNS Lookup to incomeupdate .com rev 2 2020-12-14
suricata ET MALWARE [Fireeye] SUNBURST Related DNS Lookup to virtualdataserver .com rev 2 2020-12-14
suricata ET MALWARE [Fireeye] SUNBURST Related DNS Lookup to panhardware .com rev 2 2020-12-14
suricata ET MALWARE [Fireeye] SUNBURST Related DNS Lookup to highdatabase .com rev 2 2020-12-14
suricata ET MALWARE [Fireeye] Backdoor.SUNBURST HTTP Request to digitalcollege .org rev 2 2020-12-14
suricata ET MALWARE [Fireeye] SUNBURST Related DNS Lookup to zupertech .com rev 2 2020-12-14
suricata ET MALWARE [Fireeye] SUNBURST Related DNS Lookup to websitetheme .com rev 2 2020-12-14
suricata ET MALWARE [Fireeye] Backdoor.BEACON M1 rev 2 2020-12-14
suricata ET MALWARE [Fireeye] Backdoor.SUNBURST M3 rev 2 2020-12-14
suricata ET MALWARE [Fireeye] Backdoor.SUNBURST M2 rev 2 2020-12-14
snort ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice Server] rev 4 2020-12-12
snort ET TROJAN APT LuckyMouse Polpo Malware CnC rev 2 2020-12-11