Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid UPDATE rev 6 2010-11-04
snort ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid INSERT rev 6 2010-11-04
snort ET WEB_SPECIFIC_APPS Falcon Series One sitemap.xml.php dir Parameter Local File Inclusion rev 4 2010-11-04
snort ET SCAN Watchfire AppScan Web App Vulnerability Scanner rev 6 2010-11-04
snort ET EXPLOIT Pwdump3e pwservice.exe Access port 445 rev 10 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access AUX rev 9 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access LPT3 rev 9 2010-11-04
snort ET EXPLOIT Pwdump4 Session Established GetHash port 139 rev 5 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access LPT2 rev 9 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access LPT1 rev 9 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access COM4 rev 9 2010-11-04
snort ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid UNION SELECT rev 6 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access COM3 rev 9 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access LPT4 rev 9 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access COM2 rev 9 2010-11-04
snort ET EXPLOIT SQL sp_configure attempt rev 3 2010-11-04
snort ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid DELETE rev 6 2010-11-04
snort ET ATTACK_RESPONSE r57 phpshell footer detected rev 8 2010-11-04
snort ET EXPLOIT NTDump.exe Service Started port 445 rev 8 2010-11-04
snort ET WEB_SPECIFIC_APPS F5 Data Manager ViewSatReport.do Local File Inclusion Attempt rev 3 2010-11-04
snort ET SCAN WhatWeb Web Application Fingerprint Scanner Default User-Agent Detected rev 4 2010-11-04
snort ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp SELECT rev 6 2010-11-04
snort ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex UPDATE rev 7 2010-11-04
snort ET SCAN Possible Fast-Track Tool Spidering User-Agent Detected rev 5 2010-11-04
snort ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex SELECT rev 7 2010-11-04
snort ET WEB_CLIENT Encoded javascriptdocument.write - usually hostile rev 9 2010-11-04
snort ET SCAN Amap UDP Service Scan Detected rev 5 2010-11-04
snort ET ATTACK_RESPONSE Cisco TclShell TFTP Download rev 3 2010-11-04
snort ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex INSERT rev 7 2010-11-04
snort ET SCAN Tomcat admin-blank login credentials rev 8 2010-11-04
snort ET SCAN bsqlbf Brute Force SQL Injection rev 6 2010-11-04
snort ET WEB_CLIENT Possible Adobe Acrobat Reader Newclass Invalid Pointer Remote Code Execution Attempt rev 2 2010-11-04
snort ET EXPLOIT Pwdump4 Session Established GetHash port 445 rev 5 2010-11-04
snort ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex DELETE rev 7 2010-11-04
snort ET EXPLOIT NTDump Session Established Reg-Entry port 445 rev 8 2010-11-04
snort ET WEB_SPECIFIC_APPS F5 Data Manager DiagLogListActionBody.do Local File Inclusion Attempt rev 3 2010-11-04
snort ET EXPLOIT Pwdump3e pwservice.exe Access port 139 rev 9 2010-11-04
snort ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp UNION SELECT rev 6 2010-11-04
snort ET SCAN Absinthe SQL Injection Tool HTTP Header Detected rev 7 2010-11-04
snort ET SCAN Tomcat admin-admin login credentials rev 9 2010-11-04