Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET ACTIVEX Possible Oracle AutoVue ActiveX SetMarkupMode Method Access Remote Code Execution rev 3 2012-07-23
snort ET WEB_SERVER SQL Injection BULK INSERT in URI to Insert File Content into Database Table rev 4 2012-07-23
snort ET TROJAN ProxyBox - ProxyBotCommand - I_AM rev 2 2012-07-21
snort ET TROJAN ProxyBox - HTTP CnC - getiplist.php rev 2 2012-07-21
snort ET TROJAN ProxyBox - HTTP CnC - get_servers.php rev 2 2012-07-21
snort ET TROJAN ProxyBox - HTTP CnC - .com.tw/check_version.php rev 1 2012-07-21
snort ET TROJAN ProxyBox - HTTP CnC - botinfo.php rev 2 2012-07-21
snort ET ACTIVEX Possible CA BrightStor ARCserve Backup ActiveX AddColumn Method Access Buffer Overflow 2 rev 3 2012-07-20
snort ET WEB_SPECIFIC_APPS Wordpress Plugin Newsletter data parameter Local File Inclusion vulnerability rev 1 2012-07-20
snort ET WEB_SPECIFIC_APPS Joomla com_hello controller parameter Local File Inclusion vulnerability rev 1 2012-07-20
snort ET ACTIVEX Possible CA BrightStor ARCserve Backup ActiveX AddColumn Method Access Buffer Overflow rev 2 2012-07-20
snort ET WEB_SPECIFIC_APPS Wordpress Plugin PICA Photo Gallery imgname parameter Local File Inclusion Attempt rev 1 2012-07-20
snort ET WEB_SPECIFIC_APPS Web Edition mod parameter Local File Inclusion vulnerability rev 1 2012-07-20
snort ET ACTIVEX Possible CommuniCrypt Mail SMTP ActiveX AddAttachments Method Access Stack Buffer Overflow rev 2 2012-07-20
snort ET INFO Java .jar request to dotted-quad domain rev 2 2012-07-18
snort ET POLICY TuneIn Internet Radio Usage Detected rev 1 2012-07-18
snort ET SCAN w3af User-Agent 2 rev 1 2012-07-18
snort ET WEB_SERVER Compromised Wordpress Install Serving Malicious JS rev 2 2012-07-17
snort ET TROJAN Pony Downloader check-in response STATUS-IMPORT-OK rev 5 2012-07-15
snort ET TROJAN ZeroAccess udp traffic detected rev 2 2012-07-14
snort ET CURRENT_EVENTS Document.write Long Backslash UTF-16 Encoded Content - Exploit Kit Behavior Flowbit Set rev 6 2012-07-13
snort ET ACTIVEX Possible AdminStudio Activex Control LaunchProcess Method Access Arbitrary Code Execution rev 2 2012-07-13
snort ET WEB_SPECIFIC_APPS Help Center Live file parameter Local File Inclusion vulnerability rev 1 2012-07-13
snort ET WEB_SPECIFIC_APPS joomla com_jstore controller parameter Local File Inclusion vulnerability rev 1 2012-07-13
snort ET TROJAN Win32/Pift Checkin 1 rev 1 2012-07-13
snort ET WEB_SPECIFIC_APPS joomla com_edir controller parameter Local File Inclusion vulnerability rev 1 2012-07-13
snort ET WEB_SPECIFIC_APPS joomla com_connect controller parameter Local File Inclusion vulnerability rev 1 2012-07-13
snort ET TROJAN EXE Using Suspicious IAT ZwUnmapViewOfSection Possible Malware Process Hollowing rev 4 2012-07-13
snort ET TROJAN Win32/Pift Checkin 2 rev 1 2012-07-13
snort GPL RPC portmap ttdbserv request TCP rev 19 2012-07-13
snort ET POLICY SUSPICIOUS *.pdf.exe in HTTP HEADER rev 5 2012-07-13
snort ET TROJAN Playtech Downloader Online Gaming Checkin rev 8 2012-07-13
snort ET WEB_CLIENT c3284d malware network iframe rev 2 2012-07-12
snort ET TROJAN Generic - 8Char.JAR Naming Algorithm rev 3 2012-07-12
snort ET WEB_SPECIFIC_APPS Joomla com_rssreader controller parameter Local File Inclusion Attempt rev 1 2012-07-07
snort ET ACTIVEX Possible Crystal Reports Viewer Activex Control ServerResourceVersion Insecure Method Access 2 rev 1 2012-07-07
snort ET WEB_SPECIFIC_APPS Joomla com_wisroyq controller parameter Local File Inclusion Attempt rev 1 2012-07-07
snort ET ACTIVEX Possible Crystal Reports Viewer Activex Control ServerResourceVersion Insecure Method Access rev 1 2012-07-07
snort ET ACTIVEX Possible IBM Rational ClearQuest Activex Control RegisterSchemaRepoFromFileByDbSet Insecure Method Access rev 1 2012-07-07
snort ET TROJAN W32/Numnet.Downloader CnC Checkin 1 rev 1 2012-07-04