Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort GPL NETBIOS SMB irot unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS CoGetInstanceFromFile little endian attempt rev 4 2011-09-20
snort GPL NETBIOS SMB NT Trans NT CREATE oversized Security Descriptor attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS msqueue bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS llsrconnect little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB CoGetInstanceFromFile unicode attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS llsrconnect unicode overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB IActivation unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB nddeapi bind attempt rev 6 2011-09-20
snort GPL NETBIOS SMB-DS winreg little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS IActivation little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB NDdeSetTrustedShareW unicode overflow attempt rev 6 2011-09-20
snort GPL NETBIOS SMB OpenKey overflow attempt rev 5 2011-09-20
snort GPL NETBIOS SMB winreg unicode bind attempt rev 5 2011-09-20
snort GPL NETBIOS SMB irot bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB C$ unicode share access rev 12 2011-09-20
snort GPL NETBIOS SMB-DS IPC$ share access rev 9 2011-09-20
snort GPL NETBIOS SMB CoGetInstanceFromFile little endian attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS msqueue little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS llsrpc unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS llsrconnect unicode little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB IActivation unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB msqueue little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB msqueue bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS ADMIN$ share access rev 9 2011-09-20
snort GPL NETBIOS SMB-DS RemoteActivation unicode little endian attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS OpenKey overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB winreg unicode create tree attempt rev 10 2011-09-20
snort GPL NETBIOS SMB-DS winreg unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB llsrconnect unicode little endian overflow attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS C$ share access rev 12 2011-09-20
snort GPL NETBIOS SMB-DS winreg bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB winreg create tree attempt rev 9 2011-09-20
snort GPL NETBIOS SMB ADMIN$ unicode share access rev 9 2011-09-20
snort GPL NETBIOS SMB-DS D$ share access rev 9 2011-09-20
snort GPL NETBIOS SMB ISystemActivator little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB winreg little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian attempt rev 4 2011-09-20
snort GPL NETBIOS SMB winreg unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB llsrconnect little endian overflow attempt rev 5 2011-09-20