Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET SHELLCODE Possible %u0d%u0d%u0d%u0d UTF-8 Heap Spray Attempt rev 1 2011-06-09
snort ET WEB_SPECIFIC_APPS Possible ZOHO ManageEngine ADSelfService Captcha Bypass Attempt rev 1 2011-06-09
snort ET SHELLCODE Possible 0x0b0b0b0b Heap Spray Attempt rev 1 2011-06-09
snort ET SHELLCODE Possible %u0d0d%u0d0d UTF-16 Heap Spray Attempt rev 1 2011-06-09
snort ET SHELLCODE Possible 0x0c0c0c0c Heap Spray Attempt rev 1 2011-06-09
snort ET TROJAN W32.Qakbot Request for Compromised FTP Sites rev 1 2011-06-09
snort ET SHELLCODE Possible 0x0d0d0d0d Heap Spray Attempt rev 1 2011-06-09
snort ET WEB_CLIENT Adobe Audition Malformed Session File Buffer Overflow Attempt rev 1 2011-06-09
snort GPL FTP large PWD command rev 7 2011-06-08
snort GPL FTP invalid MODE rev 8 2011-06-08
snort GPL EXPLOIT cmd32.exe access rev 5 2011-06-08
snort GPL SQL connect_data remote version detection attempt rev 7 2011-06-08
snort GPL FTP RNFR ././ attempt rev 6 2011-06-08
snort GPL FTP CWD ~ attempt rev 12 2011-06-08
snort GPL POP3 POP3 PASS overflow attempt rev 15 2011-06-08
snort GPL ATTACK_RESPONSE index of /cgi-bin/ response rev 7 2011-06-08
snort GPL WEB_SERVER perl command attempt rev 9 2011-06-08
snort GPL SCAN SSH Version map attempt rev 7 2011-06-08
snort GPL POP3 APOP overflow attempt rev 14 2011-06-08
snort ET WEB_SPECIFIC_APPS Joomla Component com_jmsfileseller view Parameter Local File Inclusion Attempt rev 1 2011-06-07
snort ET SCAN ZmEu Scanner User-Agent Inbound rev 1 2011-06-07
snort ET WEB_SPECIFIC_APPS Opencadastre soustab.php script Local File Inclusion Vulnerability rev 1 2011-06-07
snort ET WEB_SPECIFIC_APPS nvisionix Roaming System sessions.php script Local File Inclusion Attempt rev 1 2011-06-07
snort ET POLICY Smilebox Software/Adware Checkin rev 2 2011-06-06
snort ET ACTIVEX Cisco AnyConnect VPN Secure Mobility Client Cisco.AnyConnect.VPNWeb.1 Arbitrary Program Execution Attempt rev 2 2011-06-03
snort GPL ICMP_INFO PING *NIX rev 8 2011-06-02
snort ET SHELLCODE Javascript Split String Unicode Heap Spray Attempt rev 1 2011-06-02
snort GPL ICMP_INFO PING BayRS Router rev 7 2011-06-02
snort GPL SHELLCODE AIX NOOP rev 8 2011-06-02
snort GPL ICMP_INFO PING Flowpoint2200 or Network Management Software rev 7 2011-06-02
snort GPL ICMP_INFO PING BeOS4.x rev 8 2011-06-02
snort ET MOBILE_MALWARE Android/Smspacem CnC Communication Attempt rev 2 2011-06-02
snort GPL ICMP_INFO PING Cisco Type.x rev 8 2011-06-02
snort GPL ICMP_INFO PING Network Toolbox 3 Windows rev 8 2011-06-02
snort GPL SCAN webtrends scanner rev 5 2011-06-02
snort GPL ICMP_INFO PING WhatsupGold Windows rev 6 2011-06-02
snort GPL ICMP_INFO PING speedera rev 6 2011-06-02
snort GPL ICMP_INFO PING Ping-O-MeterWindows rev 8 2011-06-02
snort GPL SCAN superscan echo rev 5 2011-06-02
snort ET TROJAN Bifrose Response from Controller rev 4 2011-06-02