Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN W32/Numnet.Downloader CnC Checkin 1 rev 1 2012-07-04
snort ET TROJAN W32/Numnet.Downloader CnC Checkin 2 rev 1 2012-07-04
snort ET CURRENT_EVENTS g01pack exploit pack /mix/ payload rev 1 2012-07-04
snort ET TROJAN Zbot CnC POST /common/timestamps.php rev 1 2012-07-03
snort ET INFO Compressed Executable SZDD Compress.exe Format Over HTTP rev 2 2012-07-03
snort ET CURRENT_EVENTS NuclearPack - Landing Page Received - applet archive=32CharHex rev 4 2012-07-02
snort ET WEB_SPECIFIC_APPS Joomla com_profile controller parameter Local File Inclusion Vulnerability rev 2 2012-06-29
snort ET POLICY IncrediMail Install Callback rev 2 2012-06-29
snort ET WEB_SPECIFIC_APPS WordPress jRSS Widget url parameter Local File Inclusion Vulnerability rev 2 2012-06-29
snort ET TROJAN Zbot CnC GET /lost.dat rev 2 2012-06-28
snort ET TROJAN Zbot CnC POST /common/versions.php rev 1 2012-06-28
snort ET TROJAN Win32.Fareit.A/Pony Downloader Checkin rev 5 2012-06-27
snort ET TROJAN Backdoor Win32/Hupigon.CK Server Idle rev 1 2012-06-26
snort ET CURRENT_EVENTS - Landing Page Requested - 15Alpha1Digit.php rev 2 2012-06-26
snort ET TROJAN W32/Armageddon CnC Checkin rev 1 2012-06-26
snort ET TROJAN Backdoor Win32/Hupigon.CK Server Checkin rev 1 2012-06-26
snort ET TROJAN W32/Nutiliers.A Downloader CnC Checkin - Request Encrypted Response rev 1 2012-06-26
snort ET TROJAN Backdoor Win32/Hupigon.CK Client Checkin rev 2 2012-06-25
snort ET POLICY DynDNS CheckIp External IP Address Server Response rev 1 2012-06-22
snort ET ACTIVEX Possible Autodesk MapGuide Viewer ActiveX LayersViewWidth Method Access Denial of Service rev 2 2012-06-22
snort ET WEB_SPECIFIC_APPS WordPress Simple Download Button Shortcode Plugin Arbitrary File Disclosure Vulnerability rev 3 2012-06-22
snort ET WEB_SPECIFIC_APPS WordPress Thinkun Remind Plugin dirPath Remote File Disclosure Vulnerability rev 2 2012-06-22
snort ET ACTIVEX Possible Autodesk MapGuide Viewer ActiveX LayersViewWidth Method Access Denial of Service 2 rev 2 2012-06-22
snort ET WEB_SPECIFIC_APPS Wordpress Plugins Wp-ImageZoom file parameter Remote File Disclosure Vulnerability rev 2 2012-06-22
snort ET TROJAN WindowsEnterpriseSuite FakeAV Reporting via POST rev 6 2012-06-21
snort ET TROJAN Yahoo550.com Related Downloader/Trojan Checkin rev 5 2012-06-21
snort ET TROJAN Blackenergy Bot Checkin to C&C rev 14 2012-06-21
snort ET TROJAN Suspicious User-Agent build - possibly Delf/Troxen/Zema rev 2 2012-06-21
snort ET CURRENT_EVENTS DRIVEBY Incognito Payload Requested /getfile.php by Java Client rev 2 2012-06-20
snort ET ACTIVEX Possible IBM Lotus iNotes Upload Module possible ActiveX Control Attachment_Times Method Access Buffer Overflow Attempt rev 4 2012-06-16
snort ET ACTIVEX Possible Camera Stream Client Possible ActiveX Control SetDirectory Method Access Buffer Overflow rev 4 2012-06-15
snort ET WEB_SPECIFIC_APPS Joomla com_mscomment controller parameter Local File Inclusion Attempt rev 4 2012-06-15
snort ET WEB_SPECIFIC_APPS Joomla com_ckforms controller parameter Local File Inclusion Attempt rev 2 2012-06-15
snort ET ACTIVEX Possible Camera Stream Client Possible ActiveX Control SetDirectory Method Access Buffer Overflow 2 rev 3 2012-06-15
snort ET WEB_SPECIFIC_APPS Wordpress Plugin Tinymce Thumbnail Gallery href parameter Remote File Disclosure Attempt rev 5 2012-06-15
snort ET TROJAN W32/Fullstuff Initial Checkin rev 2 2012-06-15
snort ET WEB_SPECIFIC_APPS Joomla com_jmsfileseller view parameter Local File Inclusion Attempt rev 3 2012-06-15
snort ET WEB_SERVER Possible attempt to enumerate MS SQL Server version rev 1 2012-06-14
snort ET TROJAN Rogue.Win32/Winwebsec Install 2 rev 3 2012-06-12
snort ET TROJAN W32/Bakcorox.A ProxyBot CnC Server Connection rev 2 2012-06-12