Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort GPL NETBIOS SMB-DS winreg unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS C$ share access rev 12 2011-09-20
snort GPL NETBIOS SMB-DS NT Trans NT CREATE unicode oversized Security Descriptor attempt rev 3 2011-09-20
snort GPL NETBIOS SMB-DS winreg little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB llsrconnect overflow attempt rev 5 2011-09-20
snort GPL NETBIOS SMB llsrpc little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB IActivation unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB winreg unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS IActivation little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB nddeapi bind attempt rev 6 2011-09-20
snort GPL NETBIOS SMB-DS InitiateSystemShutdown little endian attempt rev 9 2011-09-20
snort GPL NETBIOS SMB C$ unicode share access rev 12 2011-09-20
snort GPL NETBIOS SMB-DS IActivation bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB CoGetInstanceFromFile unicode little endian attempt rev 4 2011-09-20
snort GPL NETBIOS SMB msqueue bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS ADMIN$ share access rev 9 2011-09-20
snort GPL NETBIOS SMB-DS IPC$ share access rev 9 2011-09-20
snort GPL NETBIOS SMB-DS ISystemActivator unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS irot unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB ISystemActivator unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB msqueue unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB winreg unicode create tree attempt rev 10 2011-09-20
snort GPL NETBIOS SMB IrotIsRunning little endian attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS IActivation unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS IActivation unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS winreg create tree attempt rev 8 2011-09-20
snort GPL NETBIOS SMB InitiateSystemShutdown unicode little endian attempt rev 6 2011-09-20
snort GPL NETBIOS SMB llsrpc unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB irot bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB nddeapi create tree attempt rev 5 2011-09-20
snort GPL NETBIOS SMB D$ unicode share access rev 9 2011-09-20
snort GPL NETBIOS SMB-DS llsrconnect unicode little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS OpenKey unicode overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS nddeapi unicode create tree attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS llsrconnect overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS CoGetInstanceFromFile attempt rev 4 2011-09-20
snort GPL NETBIOS SMB IActivation unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB irot little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS irot little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS RemoteActivation unicode little endian attempt rev 4 2011-09-20