Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET WEB_SPECIFIC_APPS Galerie ShowGallery.php SQL Injection attempt rev 8 2012-04-10
snort ET TROJAN OSX/Flashback.K/I User-Agent rev 3 2012-04-09
snort ET CURRENT_EVENTS Exploit Kit Delivering JAR Archive to Client rev 1 2012-04-06
snort ET INFO EXE - Served Inline HTTP rev 4 2012-04-06
snort ET INFO EXE - OSX Disk Image Download rev 3 2012-04-06
snort ET TROJAN OSX/Flashback.K first execution checkin rev 2 2012-04-06
snort ET TROJAN OSX/Flashback.K/I reporting failed infection rev 2 2012-04-06
snort ET INFO EXE - OSX Executable Download - Multi Arch w/Intel rev 3 2012-04-06
snort ET TROJAN W32/Taidoor.Backdoor CnC Checkin With Default Substitute MAC Address Field rev 1 2012-04-06
snort ET INFO EXE - OSX Executable Download - Multi Arch w/PowerPC rev 3 2012-04-06
snort ET TROJAN OSX/Flashback.K/I reporting successful infection rev 2 2012-04-06
snort ET TROJAN Win32.Datamaikon Checkin myAgent rev 2 2012-04-06
snort ET WEB_CLIENT Internet Explorer CTableRowCellsCollectionCacheItem.GetNext Memory Use-After-Free Attempt rev 2 2012-04-04
snort ET ACTIVEX Ask.com Toolbar askBar.dll ActiveX ShortFormat Buffer Overflow Attempt rev 5 2012-04-03
snort ET ACTIVEX TRENDnet TV-IP121WN UltraMJCam ActiveX Control OpenFileDlg Access Potential Remote Stack Buffer Overflow 2 rev 5 2012-04-03
snort ET POLICY PPTP Requester is not authorized to establish a command channel rev 4 2012-04-02
snort ET ACTIVEX Dell Webcam CrazyTalk ActiveX Control BackImage Access Potential Buffer Overflow Attempt rev 2 2012-04-01
snort ET ACTIVEX TRENDnet TV-IP121WN UltraMJCam ActiveX Control OpenFileDlg Access Potential Remote Stack Buffer Overflow rev 4 2012-04-01
snort GPL WEB_SERVER DELETE attempt rev 14 2012-03-28
snort ET TROJAN Yayih.A Checkin rev 2 2012-03-27
snort ET TROJAN Backdoor.Win32.RShot HTTP Checkin rev 2 2012-03-27
snort ET WEB_SPECIFIC_APPS Joomla Community component userid parameter SELECT FROM SQL Injection Attempt rev 3 2012-03-27
snort ET TROJAN UPDATE Protocol Trojan Communication detected on non-http ports 2 rev 5 2012-03-27
snort ET TROJAN W32/GamesForum.InfoStealer Reporting to CnC rev 2 2012-03-27
snort ET TROJAN TROJAN Win32-WebSec Reporting rev 4 2012-03-26
snort ET TROJAN Trojan Downloader.Bancos Reporting rev 3 2012-03-26
snort ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ExportSettings Function Call Attempt rev 2 2012-03-26
snort ET TROJAN W32/Jiwerks.A Checkin rev 4 2012-03-26
snort ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ExportSettings Remote File Overwrite Attempt rev 2 2012-03-26
snort ET TROJAN MSUpdater POST checkin to CnC rev 2 2012-03-26
snort ET WEB_SPECIFIC_APPS VTiger CRM module_name parameter Local File Inclusion Attempt rev 2 2012-03-26
snort ET WEB_SPECIFIC_APPS OneFileCMS f parameter Local File Inclusion Attempt rev 2 2012-03-26
snort ET TROJAN SpyEye Checkin version 1.3.25 or later rev 4 2012-03-26
snort ET ACTIVEX 2X Client for RDP ClientSystem Class ActiveX Control InstallClient Function Call Attempt rev 2 2012-03-26
snort ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ImportSettings Function Call Attempt rev 3 2012-03-26
snort ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ImportSettings Remote File Overwrite Attempt rev 4 2012-03-26
snort ET TROJAN Backdoor.Win32.Ixeshe rev 4 2012-03-23
snort ET TROJAN Backdoor.Win32.Sykipot Get Config Request rev 4 2012-03-23
snort ET TROJAN Cycbot POST rev 2 2012-03-22
snort ET TROJAN Win32.PEx.Delphi.1151005043 Post-infection Checkin rev 2 2012-03-22