Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort GPL NETBIOS SMB winreg unicode bind attempt rev 5 2011-09-20
snort GPL NETBIOS SMB IrotIsRunning little endian attempt rev 5 2011-09-20
snort GPL NETBIOS SMB RemoteActivation unicode attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS nddeapi unicode create tree attempt rev 5 2011-09-20
snort GPL NETBIOS SMB IrotIsRunning attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS CoGetInstanceFromFile attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS OpenKey overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS llsrconnect overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS irot little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS ISystemActivator bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB irot little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB llsrpc bind attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS NDdeSetTrustedShareW unicode overflow attempt rev 7 2011-09-20
snort GPL NETBIOS SMB NT Trans NT CREATE oversized Security Descriptor attempt rev 5 2011-09-20
snort GPL NETBIOS SMB irot unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS OpenKey unicode little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS C$ unicode share access rev 11 2011-09-20
snort GPL NETBIOS SMB-DS NDdeSetTrustedShareW overflow attempt rev 6 2011-09-20
snort GPL NETBIOS SMB IActivation bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB RemoteActivation little endian attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS llsrpc unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS CoGetInstanceFromFile little endian attempt rev 4 2011-09-20
snort GPL NETBIOS SMB InitiateSystemShutdown unicode attempt rev 6 2011-09-20
snort GPL NETBIOS SMB NDdeSetTrustedShareW little endian overflow attempt rev 7 2011-09-20
snort GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB IrotIsRunning unicode little endian attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS InitiateSystemShutdown unicode attempt rev 10 2011-09-20
snort GPL NETBIOS SMB irot unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB CoGetInstanceFromFile little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB NDdeSetTrustedShareW overflow attempt rev 6 2011-09-20
snort GPL NETBIOS SMB-DS irot bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB winreg unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS InitiateSystemShutdown little endian attempt rev 9 2011-09-20
snort GPL NETBIOS SMB-DS C$ share access rev 12 2011-09-20
snort GPL NETBIOS SMB llsrconnect overflow attempt rev 5 2011-09-20
snort GPL NETBIOS SMB IActivation unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS nddeapi bind attempt rev 6 2011-09-20
snort GPL NETBIOS SMB-DS winreg bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS NT Trans NT CREATE unicode oversized Security Descriptor attempt rev 3 2011-09-20
snort GPL NETBIOS SMB-DS winreg unicode bind attempt rev 9 2011-09-20