Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort GPL NETBIOS SMB-DS DCERPC Remote Activation bind attempt rev 15 2012-01-16
snort ET POLICY Softango.com Installer POSTing Data rev 2 2012-01-13
snort ET POLICY Softango.com Installer Checking For Update rev 1 2012-01-12
snort ET TROJAN Win32.UFRStealer.A issuing MKD command FTP rev 4 2012-01-10
snort ET POLICY Suspicious Invalid HTTP Accept Header of ? rev 2 2012-01-06
snort ET POLICY Outbound MSSQL Connection to Non-Standard Port - Likely Malware rev 3 2012-01-04
snort ET TROJAN Incognito Exploit Kit Checkin rev 4 2012-01-04
snort ET POLICY Dyndns Client User-Agent rev 1 2012-01-03
snort ET POLICY Dyndns Client IP Check rev 1 2012-01-03
snort ET WEB_SPECIFIC_APPS SourceBans ajaxargs Parameter Local File Inclusion Attempt rev 2 2012-01-03
snort ET WEB_SPECIFIC_APPS Mambo Zorder zorder Parameter DELETE FROM SQL Injection Vulnerability rev 4 2012-01-03
snort ET WEB_SPECIFIC_APPS Mambo Zorder zorder Parameter SELECT FROM SQL Injection Vulnerability rev 4 2012-01-03
snort ET WEB_SPECIFIC_APPS Mambo Zorder zorder Parameter UPDATE SET SQL Injection Vulnerability rev 2 2012-01-03
snort ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter UNION SELECT SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter DELETE FROM SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS Joomla com_dshop Component UPDATE SET SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS Joomla com_dshop Component SELECT FROM SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS Joomla com_dshop Component INSERT INTO SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS WordPress DB XML dump successful leakage rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS Joomla com_dshop Component DELETE FROM SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS Joomla com_dshop Component UNION SELECT SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter UPDATE SET SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter SELECT FROM SQL Injection Attempt rev 2 2012-01-02
snort ET TROJAN Double HTTP/1.1 Header Inbound - Likely Hostile Traffic rev 1 2011-12-30
snort ET TROJAN Gootkit Checkin User-Agent 2 rev 1 2011-12-13
snort ET WEB_SERVER JBoss jmx-console Probe rev 1 2011-12-10
snort ET TROJAN Smokeloader getproxy Command rev 1 2011-12-09
snort ET TROJAN Backdoor.Win32.Sykipot Put rev 1 2011-12-09
snort ET TROJAN Smokeloader getgrab Command rev 1 2011-12-09
snort ET TROJAN Smokeloader getload Command rev 1 2011-12-09
snort ET TROJAN Smokeloader getsock Command rev 1 2011-12-09
snort ET SCAN SQLix SQL Injection Vector Scan rev 7 2011-12-08
snort ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby rev 2 2011-12-07
snort ET WEB_SPECIFIC_APPS Zabbix popup.php DELETE FROM SQL Injection Vulnerability rev 2 2011-12-02
snort GPL FTP piss scan rev 7 2011-12-02
snort GPL FTP pass wh00t rev 7 2011-12-02
snort ET WEB_SPECIFIC_APPS Zabbix popup.php UPDATE SET SQL Injection Vulnerability rev 2 2011-12-02
snort GPL FTP tar parameters rev 14 2011-12-02
snort GPL FTP saint scan rev 7 2011-12-02
snort ET WEB_SPECIFIC_APPS Zabbix popup.php INSERT INTO SQL Injection Vulnerability rev 2 2011-12-02