Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Win32.PEx.Delphi.1151005043 Post-infection Checkin rev 2 2012-03-22
snort ET TROJAN W32/Mnless Checkin rev 3 2012-03-21
snort ET TROJAN Possible Ponmocup Driveby Download rev 2 2012-03-21
snort ET TROJAN Win32.Shiz.fxm/Agent-TBT Checkin rev 5 2012-03-21
snort ET TROJAN Backdoor.Win32/Momibot Checkin rev 4 2012-03-21
snort ET TROJAN Backdoor.Win32/Momibot Ping Checkin rev 2 2012-03-21
snort ET TROJAN Internet Protection FakeAV checkin rev 2 2012-03-20
snort ET TROJAN BestAntivirus2011 Fake AV reporting rev 2 2012-03-20
snort GPL DNS named version attempt rev 10 2012-03-20
snort ET TROJAN Generic Bot Checkin rev 7 2012-03-20
snort ET CURRENT_EVENTS DRIVEBY Incognito Payload Download /load/*exe rev 4 2012-03-20
snort ET TROJAN Generic Dropper/Clicker Checkin rev 4 2012-03-20
snort ET TROJAN Win32/Virut.BN Checkin rev 6 2012-03-20
snort ET WORM W32/Rimecud wg.txt Checkin rev 1 2012-03-20
snort ET TROJAN DonBot Checkin rev 3 2012-03-20
snort ET WEB_SPECIFIC_APPS RJ-iTop Network Vulnerabilities Scan System id UPDATE SET SQL Injection Attempt rev 4 2012-03-20
snort ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php pid INSERT rev 6 2012-03-20
snort ET TROJAN Win32.Meredrop Checkin rev 3 2012-03-20
snort ET TROJAN W32.Qakbot Webpage Infection Routine POST rev 2 2012-03-20
snort ET WEB_SPECIFIC_APPS RJ-iTop Network Vulnerabilities Scan System id INSERT INTO SQL Injection Attempt rev 4 2012-03-20
snort ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php cid UPDATE rev 6 2012-03-20
snort ET TROJAN Win32.FakeAV.chhq Checkin rev 8 2012-03-20
snort ET TROJAN Papras Banking Trojan Checkin rev 4 2012-03-20
snort ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php pid SELECT rev 6 2012-03-20
snort ET TROJAN Zeus Bot GET to Google checking Internet connectivity rev 6 2012-03-20
snort ET TROJAN Trojan Internet Connectivity Check rev 4 2012-03-20
snort ET WEB_SPECIFIC_APPS Joomla techfolio component UNION SELECT SQL Injection Attempt rev 3 2012-03-19
snort ET TROJAN TrojanDownloader Win32/Harnig.gen-P Reporting rev 4 2012-03-19
snort ET TROJAN Downloader.Win32.Banload Reporting rev 3 2012-03-19
snort ET TROJAN Suspicious exe.exe request - possible downloader/Oficla rev 4 2012-03-19
snort ET TROJAN Driveby Exploit Attempt Often to Install Monkif rev 5 2012-03-19
snort ET WEB_SPECIFIC_APPS Joomla techfolio component INSERT INTO SQL Injection Attempt rev 3 2012-03-19
snort ET SCADA Sunway ForceControl Activex Control Remote Code Execution Vulnerability 2 rev 4 2012-03-19
snort ET WEB_SPECIFIC_APPS Joomla techfolio component DELETE FROM SQL Injection Attempt rev 3 2012-03-19
snort ET WEB_SPECIFIC_APPS Joomla com_kp controller parameter Local File Inclusion Attempt rev 2 2012-03-17
snort ET TROJAN Carberp CnC request POST /set/task.html rev 3 2012-03-17
snort ET WEB_SPECIFIC_APPS Joomla com_rule controller Local File Inclusion Attempt rev 2 2012-03-17
snort ET TROJAN carberp check in rev 3 2012-03-17
snort ET ACTIVEX EdrawSoft Office Viewer Component ActiveX FtpUploadFile Format String Function Call Attempt rev 2 2012-03-17
snort ET TROJAN Storm/Waledac 3.0 Checkin 2 rev 6 2012-03-17