Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort GPL ICMP_INFO PING Cisco Type.x rev 8 2011-06-02
snort GPL ICMP_INFO PING IP NetMonitor Macintosh rev 8 2011-06-02
snort GPL ICMP_INFO PING BeOS4.x rev 8 2011-06-02
snort GPL ICMP_INFO PING BSDtype rev 7 2011-06-02
snort GPL SCAN PING Delphi-Piette Windows rev 8 2011-06-02
snort GPL ICMP_INFO PING Pinger Windows rev 8 2011-06-02
snort GPL SCAN PING CyberKit 2.2 Windows rev 6 2011-06-02
snort GPL ICMP_INFO PING *NIX rev 8 2011-06-02
snort GPL SCAN ISS Pinger rev 4 2011-06-02
snort ET TROJAN Bifrose Response from Controller rev 4 2011-06-02
snort ET ACTIVEX Magneto ICMP ActiveX ICMPSendEchoRequest Remote Code Execution Attempt rev 1 2011-05-31
snort ET TROJAN Known Skunkx DDOS Bot User-Agent Cyberdog rev 1 2011-05-31
snort ET WEB_SPECIFIC_APPS TCExam tce_xml_user_results.php script SELECT FROM SQL Injection Attempt rev 1 2011-05-27
snort ET WEB_SPECIFIC_APPS TCExam tce_xml_user_results.php script UNION SELECT SQL Injection Attempt rev 1 2011-05-27
snort ET WEB_SPECIFIC_APPS TCExam tce_xml_user_results.php script UPDATE SET SQL Injection Attempt rev 1 2011-05-27
snort ET WEB_SPECIFIC_APPS TCExam tce_xml_user_results.php script DELETE FROM SQL Injection Attempt rev 1 2011-05-27
snort ET WEB_SPECIFIC_APPS TCExam tce_xml_user_results.php script INSERT INTO SQL Injection Attempt rev 1 2011-05-27
snort GPL FTP CWD ~<CR><NEWLINE> attempt rev 8 2011-05-25
snort GPL EXPLOIT xp_cmdshell program execution 445 rev 6 2011-05-25
snort ET SCAN Sqlmap SQL Injection Scan rev 8 2011-05-25
snort ET POLICY Hotmail Inbox Access rev 3 2011-05-25
snort GPL RPC portmap rwalld request TCP rev 10 2011-05-25
snort GPL SQL MYSQL show databases attempt rev 4 2011-05-25
snort GPL RPC portmap cachefsd request TCP rev 12 2011-05-25
snort GPL RPC portmap cachefsd request UDP rev 12 2011-05-25
snort GPL FTP CWD .... attempt rev 4 2011-05-25
snort GPL SQL MYSQL root login attempt rev 4 2011-05-25
snort GPL RPC portmap rwalld request UDP rev 10 2011-05-25
snort ET POLICY Cleartext WordPress Login rev 2 2011-05-25
snort ET SCAN Rapid IMAPS Connections - Possible Brute Force Attack rev 9 2011-05-23
snort ET SCAN Rapid IMAP Connections - Possible Brute Force Attack rev 6 2011-05-23
snort ET WEB_SPECIFIC_APPS Joomla Component com_hello UNION SELECT SQL Injection Attempt rev 1 2011-05-20
snort ET WEB_SPECIFIC_APPS Joomla Component com_hello SELECT FROM SQL Injection Attempt rev 1 2011-05-20
snort ET WEB_SPECIFIC_APPS Joomla Component com_hello INSERT INTO SQL Injection Attempt rev 1 2011-05-20
snort ET WEB_SPECIFIC_APPS Joomla Component com_hello DELETE FROM SQL Injection Attempt rev 1 2011-05-20
snort ET WEB_SPECIFIC_APPS Joomla Component com_hello UPDATE SET SQL Injection Attempt rev 1 2011-05-20
snort GPL WEB_SERVER Oracle Java Process Manager access rev 4 2011-05-18
snort ET WEB_CLIENT PDF With Adobe Audition Session File Handling Memory Corruption Attempt rev 1 2011-05-18
snort ET WEB_SPECIFIC_APPS Cisco Unified Operations Manager Blind SQL Injection Attempt rev 1 2011-05-18
snort GPL IMAP authenticate overflow attempt rev 12 2011-05-17