Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Magecart CnC Domain Observed in DNS Query rev 2 2020-10-23
snort ET MALWARE FLV/Youtube Downloader Install Activity rev 2 2020-10-22
snort ET TROJAN Bazaloader Variant Activity rev 2 2020-10-22
snort ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server rev 2 2020-10-22
snort ET TROJAN Bazaloader Variant Activity rev 2 2020-10-22
snort ET WEB_CLIENT Generic File Upload Accessed on External Compromised Server rev 2 2020-10-22
snort ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server rev 2 2020-10-22
snort ET WEB_SERVER Generic File Upload Accessed on Internal Compromised Server rev 2 2020-10-22
suricata ET WEB_SERVER Generic File Upload Accessed on Internal Compromised Server rev 2 2020-10-22
suricata ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server rev 2 2020-10-22
suricata ET WEB_CLIENT Generic File Upload Accessed on External Compromised Server rev 2 2020-10-22
suricata ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server rev 2 2020-10-22
snort ET TROJAN Win32/Ficker Stealer Activity rev 1 2020-10-21
suricata ET MALWARE Gamaredon CnC Domain Observed in DNS Query rev 2 2020-10-21
suricata ET WEB_CLIENT Tech Support Scam 2019-11-14 rev 2 2020-10-21
suricata ET MALWARE Gamaredon CnC Domain Observed in DNS Query rev 2 2020-10-21
suricata ET MALWARE Win32/Ficker Stealer Activity rev 1 2020-10-21
suricata ET MALWARE Gamaredon CnC Domain Observed in DNS Query rev 3 2020-10-21
suricata ET MALWARE StrongPity CnC Domain Observed in DNS Query rev 2 2020-10-21
suricata ET WEB_CLIENT Tech Support Scam 2019-11-14 rev 2 2020-10-21
snort ET CURRENT_EVENTS Apple Phishing Panel Accessed on External Server rev 2 2020-10-20
snort ET TROJAN VBS/Dojos Downloader Activity M2 rev 2 2020-10-20
snort ET CURRENT_EVENTS Suntrust Captcha Phishing Landing rev 2 2020-10-20
snort ET CURRENT_EVENTS Apple Phishing Panel Accessed on Internal Server rev 2 2020-10-20
suricata ET MALWARE Diezen/Sakabota CnC Domain Observed in DNS Query rev 2 2020-10-20
suricata ET MALWARE PolyglotDuke Domain Observed rev 2 2020-10-20
suricata ET MALWARE Lazarus CnC Domain Observed in DNS Query rev 2 2020-10-20
suricata ET MALWARE Kimsuky CnC Domain Observed in DNS Query rev 2 2020-10-20
suricata ET MALWARE Kimsuky CnC Domain Observed in DNS Query rev 2 2020-10-20
suricata ET MALWARE FatDuke Domain Observed rev 2 2020-10-20
suricata ET MALWARE PolyglotDuke Domain Observed rev 2 2020-10-20
suricata ET PHISHING Apple Phishing Panel Accessed on Internal Server rev 2 2020-10-20
suricata ET MALWARE LiteDuke Domain Observed rev 2 2020-10-20
suricata ET PHISHING Apple Phishing Panel Accessed on External Server rev 2 2020-10-20
suricata ET MALWARE PolyglotDuke Domain Observed rev 2 2020-10-20
suricata ET MALWARE Diezen/Sakabota CnC Domain Observed in DNS Query rev 2 2020-10-20
suricata ET MALWARE PolyglotDuke Domain Observed rev 2 2020-10-20
suricata ET MALWARE PolyglotDuke Domain Observed rev 2 2020-10-20
suricata ET MALWARE APT-C-27 CnC Domain Observed in DNS Query rev 2 2020-10-20
suricata ET MALWARE MiniDuke Domain Observed rev 2 2020-10-20