Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE MSUpdater POST checkin to CnC rev 4 2020-04-21
suricata ET INFO Softango.com Installer POSTing Data rev 5 2020-04-21
suricata ET MALWARE Zbot CnC POST /common/timestamps.php rev 3 2020-04-21
suricata ET WEB_SPECIFIC_APPS Joomla Community component userid parameter SELECT FROM SQL Injection Attempt rev 5 2020-04-21
suricata ET MALWARE SpyEye Checkin version 1.3.25 or later rev 5 2020-04-21
suricata ET INFO Http Client Body contains pwd= in cleartext rev 4 2020-04-21
suricata ET MALWARE Win32.PEx.Delphi.1151005043 Post-infection Checkin rev 4 2020-04-21
suricata ET MALWARE Downloader.VB.TX/Backdoor.Win32.DSSdoor!IK Checkin rev 10 2020-04-21
suricata ET MALWARE Common Downloader Access Count Tracking URL rev 6 2020-04-21
suricata ET MALWARE W32/Backdoor.BlackMonay Checkin rev 4 2020-04-21
suricata ET WEB_SERVER Possible attempt to enumerate MS SQL Server version rev 3 2020-04-21
suricata ET WEB_SPECIFIC_APPS RJ-iTop Network Vulnerabilities Scan System id UPDATE SET SQL Injection Attempt rev 6 2020-04-21
suricata ET MALWARE Bot Backdoor Checkin/registration Request rev 8 2020-04-21
suricata ET MALWARE Trojan.Win32.Buzus Checkin rev 6 2020-04-21
suricata ET MALWARE OSX/Flashback.K first execution checkin rev 5 2020-04-21
suricata ET MALWARE Yahoo550.com Related Downloader/Trojan Checkin rev 6 2020-04-21
suricata ET MALWARE TROJAN Win32-WebSec Reporting rev 6 2020-04-21
suricata ET WEB_SPECIFIC_APPS RJ-iTop Network Vulnerabilities Scan System id INSERT INTO SQL Injection Attempt rev 5 2020-04-21
suricata ET MALWARE Generic Checkin - MSCommonInfoEx rev 6 2020-04-21
suricata ET MALWARE Trojan.Win32.Genome.aetqe Checkin rev 2 2020-04-21
suricata ET SCAN Vega Web Application Scan rev 4 2020-04-21
suricata ET WEB_SPECIFIC_APPS pfile file.php id Parameter DELETE FROM SQL Injection Attempt rev 4 2020-04-21
suricata ET MALWARE Common Downloader Install Count Tracking URL rev 6 2020-04-21
suricata ET MALWARE Win32 Dialer Variant rev 9 2020-04-21
suricata ET MALWARE RegHelper Installation rev 6 2020-04-21
suricata ET WEB_SPECIFIC_APPS IBBY nouvelles.php id Parameter UNION SELECT SQL Injection Attempt rev 4 2020-04-21
suricata ET EXPLOIT_KIT DRIVEBY Incognito Payload Requested /getfile.php by Java Client rev 2 2020-04-21
suricata ET WEB_SERVER /bin/ksh In URI Possible Shell Command Execution Attempt rev 6 2020-04-21
suricata ET EXPLOIT_KIT Sakura Exploit Kit Binary Load Request rev 3 2020-04-21
suricata ET INFO File Being Uploaded to SendSpace File Hosting Site rev 3 2020-04-21
suricata ET MALWARE OSX/Flashback.K/I reporting successful infection rev 5 2020-04-21
suricata ET WEB_SERVER /bin/csh In URI Possible Shell Command Execution Attempt rev 5 2020-04-21
suricata ET WEB_SPECIFIC_APPS IBBY nouvelles.php id Parameter DELETE FROM SQL Injection Attempt rev 4 2020-04-21
suricata ET MALWARE Lop.gfr/Swizzor HTTP Update/Checkin rev 10 2020-04-21
suricata ET MALWARE Carberp checkin task rev 8 2020-04-21
suricata ET MALWARE Win32/Chekafe.A or Related Infection Checkin rev 6 2020-04-21
suricata ET EXPLOIT_KIT Incognito Exploit Kit Java request to images.php?t= rev 3 2020-04-21
suricata ET MALWARE W32/DelfInject.A CnC Checkin 2 rev 3 2020-04-21
suricata ET MOBILE_MALWARE Android/Plankton.P Commands Request to CnC Server rev 3 2020-04-21
suricata ET MALWARE W32/Downvision.A Initial Checkin rev 5 2020-04-21