Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort GPL NETBIOS SMB InitiateSystemShutdown unicode little endian attempt rev 6 2011-09-20
snort GPL NETBIOS SMB msqueue unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS IActivation bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS nddeapi create tree attempt rev 5 2011-09-20
snort GPL NETBIOS SMB winreg unicode create tree attempt rev 10 2011-09-20
snort GPL NETBIOS SMB-DS winreg little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS llsrconnect unicode little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS IrotIsRunning unicode attempt rev 6 2011-09-20
snort GPL NETBIOS SMB-DS msqueue unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS ISystemActivator unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS ADMIN$ share access rev 9 2011-09-20
snort GPL NETBIOS SMB-DS irot unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB llsrpc unicode little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB nddeapi bind attempt rev 6 2011-09-20
snort GPL NETBIOS SMB D$ unicode share access rev 9 2011-09-20
snort GPL NETBIOS SMB nddeapi create tree attempt rev 5 2011-09-20
snort ET WEB_SPECIFIC_APPS Simplis CMS download_file Parameter Local File Inclusion Attempt rev 2 2011-09-19
snort ET WEB_SPECIFIC_APPS WordPress Tune Library Plugin letter parameter UPDATE SET SQL Injection Attempt rev 2 2011-09-19
snort ET WEB_SPECIFIC_APPS WordPress Tune Library Plugin letter parameter SELECT FROM SQL Injection Attempt rev 2 2011-09-19
snort ET WEB_SPECIFIC_APPS WordPress Tune Library Plugin letter parameter DELETE FROM SQL Injection Attempt rev 2 2011-09-19
snort ET WEB_SPECIFIC_APPS WordPress Tune Library Plugin letter parameter INSERT INTO SQL Injection Attempt rev 2 2011-09-19
snort ET WEB_SPECIFIC_APPS WordPress Tune Library Plugin letter parameter UNION SELECT SQL Injection Attempt rev 2 2011-09-19
snort GPL ATTACK_RESPONSE id check returned web rev 8 2011-09-16
snort ET TROJAN Downbot/Shady Rat Remote Shell Connection rev 3 2011-09-15
snort ET WEB_SPECIFIC_APPS bug_actiongroup_ext_page.php script Local File Inclusion Attempt rev 2 2011-09-12
snort ET ACTIVEX Tom Sawyer Possible Memory Corruption Attempt Format String Function Call rev 2 2011-09-12
snort ET WEB_SPECIFIC_APPS bug_actiongroup_page.php script Local File Inclusion Attempt rev 2 2011-09-12
snort ET TROJAN FakeAV Landing Page rev 3 2011-09-08
snort ET TROJAN W32/iGrabber Info Stealer FTP Upload rev 2 2011-09-06
snort ET TROJAN W32/Gagolino Banking Trojan Reporting to CnC rev 1 2011-09-06
snort ET TROJAN BKDR_BTMINE.MNR BitCoin Miner Retrieving Server IP Addresses rev 1 2011-09-06
snort ET TROJAN BKDR_BTMINE.MNR BitCoin Miner Server Checkin rev 1 2011-09-06
snort ET TROJAN Driveby Loader Request List.php rev 1 2011-09-02
snort ET POLICY GNU/Linux YUM User-Agent Outbound likely related to package management rev 1 2011-09-02
snort ET POLICY OS X Software Update Request Outbound rev 3 2011-08-31
snort ET TROJAN W32/Lalus Trojan Downloader Checkin rev 1 2011-08-31
snort ET TROJAN Zeus Bot GET to Bing checking Internet connectivity rev 1 2011-08-30
snort ET POLICY Netflix Streaming Player Access rev 1 2011-08-30
snort ET POLICY SUSPICIOUS *.doc.exe in HTTP HEADER rev 6 2011-08-29
snort ET TROJAN Meredrop/Nusump Checkin rev 4 2011-08-29