Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET WEB_SERVER auto_prepend_file PHP config option in uri rev 2 2013-06-06
snort ET WEB_SERVER suhosin.simulation PHP config option in uri rev 3 2013-06-06
snort ET TROJAN Win32/Travnet.A Checkin rev 4 2013-06-06
snort ET CURRENT_EVENTS Sakura obfuscated javascript Jun 1 2013 rev 7 2013-06-04
snort ET TROJAN W32/Symmi Remote File Injector Initial CnC Beacon rev 1 2013-06-04
snort ET EXPLOIT Apache Struts Possible OGNL AllowStaticMethodAccess in client body rev 2 2013-06-01
snort ET EXPLOIT Apache Struts Possible OGNL AllowStaticMethodAccess in URI rev 2 2013-06-01
snort ET TROJAN Dorkbot GeoIP Lookup to wipmania rev 6 2013-06-01
snort ET EXPLOIT Apache Struts Possible OGNL Java WriteFile in client_body rev 2 2013-06-01
snort ET EXPLOIT Apache Struts Possible OGNL Java WriteFile in URI rev 2 2013-06-01
snort ET TROJAN Backdoor.Win32.Trup.CX Checkin 1 rev 4 2013-05-31
snort ET TROJAN Possible Win32.Bicololo Checkin rev 2 2013-05-31
snort ET TROJAN W32/Safe User Agent Fantasia rev 1 2013-05-29
snort ET TROJAN Variant.Kazy.174106 Checkin rev 1 2013-05-29
snort ET TROJAN Vobfus Check-in rev 1 2013-05-29
snort ET WEB_SERVER Apache Struts Possible xwork Disable Method Execution rev 1 2013-05-24
snort ET POLICY Unsupported/Fake Internet Explorer Version MSIE 3. rev 2 2013-05-24
snort ET POLICY Unsupported/Fake Internet Explorer Version MSIE 1. rev 2 2013-05-24
snort ET POLICY Unsupported/Fake FireFox Version 2. rev 2 2013-05-24
snort ET POLICY Unsupported/Fake FireFox Version 0. rev 2 2013-05-24
snort ET POLICY Unsupported/Fake Internet Explorer Version MSIE 2. rev 2 2013-05-24
snort ET POLICY Unsupported/Fake Windows NT Version 5.0 rev 2 2013-05-24
snort ET POLICY Unsupported/Fake FireFox Version 1. rev 2 2013-05-24
snort ET POLICY Unsupported/Fake Windows NT Version 4. rev 2 2013-05-24
snort ET TROJAN Trojan.Win32.Antavmu.guw Checkin rev 1 2013-05-23
snort ET TROJAN W32/Briba CnC POST Beacon rev 3 2013-05-22
snort ET TROJAN Backdoor.Win32.Agent.bjjv Checkin rev 1 2013-05-21
snort ET TROJAN Trojan-Spy.Win32.KeyLogger.acuj Checkin rev 2 2013-05-21
snort ET INFO Possible Firefox Plugin install rev 2 2013-05-21
snort ET TROJAN Hangover Campaign Keylogger Checkin rev 1 2013-05-21
snort ET TROJAN Trojan.Win32.VB.cefz Checkin rev 1 2013-05-21
snort ET TROJAN Lyposit Ransomware Checkin 1 rev 5 2013-05-20
snort ET TROJAN Embedded Android Dalvik Executable File With Fake Windows Executable Header - Possible AV Bypass Attempt rev 2 2013-05-16
snort ET POLICY Android Dalvik Executable File Download rev 1 2013-05-16
snort ET WEB_SERVER HTTPing Usage Inbound rev 1 2013-05-14
snort ET WEB_SERVER ColdFusion scheduleedit access rev 1 2013-05-14
snort ET TROJAN Trojan-Downloader.Win32.AutoIt.mj Checkin rev 1 2013-05-14
snort ET TROJAN Possible Linux/Cdorked.A CnC rev 1 2013-05-14
snort ET WEB_SERVER ColdFusion scheduletasks access rev 1 2013-05-14
snort ET INFO Possible Chrome Plugin install rev 1 2013-05-14