Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET MOBILE_MALWARE Android/GoldDream Infected Device Registration rev 3 2013-03-20
snort ET TROJAN RevProxy Java Settings rev 3 2013-03-19
snort GPL RPC portmap sadmind request TCP rev 11 2013-03-18
snort GPL RPC portmap bootparam request TCP rev 14 2013-03-18
snort GPL RPC portmap yppasswd request TCP rev 11 2013-03-18
snort GPL RPC portmap ypserv request TCP rev 15 2013-03-18
snort GPL RPC portmap pcnfsd request TCP rev 13 2013-03-18
snort GPL RPC portmap rusers request TCP rev 15 2013-03-18
snort GPL RPC portmap cmsd request TCP rev 10 2013-03-18
snort GPL RPC portmap admind request TCP rev 10 2013-03-18
snort GPL RPC portmap rstatd request TCP rev 12 2013-03-18
snort GPL NETBIOS RFParalyze Attempt rev 10 2013-03-18
snort GPL RPC portmap selection_svc request TCP rev 11 2013-03-18
snort GPL RPC portmap amountd request TCP rev 12 2013-03-18
snort GPL POP3 APOP USER overflow attempt rev 2 2013-03-18
snort GPL RPC portmap rexd request TCP rev 11 2013-03-18
snort GPL RPC portmap nisd request TCP rev 12 2013-03-18
snort ET DNS APT_NGO_wuaclt C2 Domain micorsofts.com rev 2 2013-03-15
snort ET CURRENT_EVENTS Redkit Landing Page URL March 03 2013 rev 5 2013-03-15
snort ET TROJAN APT_NGO_wuaclt PDF file rev 1 2013-03-15
snort ET TROJAN W32/LetsGo.APT Sleep CnC Beacon rev 1 2013-03-14
snort ET DNS APT_NGO_wuaclt C2 Domain hotmal1.com rev 1 2013-03-14
snort ET TROJAN APT_NGO_wuaclt C2 Check-in rev 1 2013-03-14
snort ET WEB_SERVER WebShell - MySQL Interface - Database List rev 1 2013-03-14
snort ET TROJAN APT_NGO_wuaclt rev 1 2013-03-14
snort ET WEB_SERVER WebShell - MySQL Interface - Client Cookie mysql_web_admin*= rev 1 2013-03-14
snort ET DNS APT_NGO_wuaclt C2 Domain micorsofts.net rev 3 2013-03-14
snort ET WEB_SERVER WebShell - MySQL Interface - Server Set Cookie mysql_web_admin*= rev 1 2013-03-14
snort ET WEB_SERVER WebShell - Romanian Webshell rev 4 2013-03-14
snort ET TROJAN W32/Trustezeb.C CnC Beacon rev 1 2013-03-08
snort ET CURRENT_EVENTS SUSPICIOUS JAR Download by Java UA with non JAR EXT matches various EKs rev 2 2013-03-07
snort ET TROJAN Win32/Fareit Checkin 2 rev 3 2013-03-07
snort ET TROJAN Stabuniq Checkin rev 2 2013-03-07
snort ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download rev 2 2013-03-07
snort ET TROJAN W32/TrojanSpy.MSIL Fetch Header CnC Beacon rev 1 2013-03-05
snort ET TROJAN W32/TrojanSpy.MSIL Fetch Time CnC Beacon rev 1 2013-03-05
snort ET TROJAN W32/TrojanSpy.MSIL Get New MAC CnC Beacon rev 1 2013-03-05
snort ET TROJAN W32/TrojanSpy.MSIL Set Done Day CnC Beacon rev 1 2013-03-05
snort ET CURRENT_EVENTS Unknown Exploit Kit Exploit Request rev 1 2013-03-05
snort ET WEB_SERVER WebShell - Generic - c99shell based POST structure rev 1 2013-03-04