Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET SCAN Grim's Ping ftp scanning tool rev 6 2010-10-04
snort ET TROJAN Shark Pass Stealer Email Report rev 3 2010-10-04
snort ET TROJAN Banito/Agent.pb Pass Stealer Email Report Outbound rev 3 2010-10-04
snort ET TROJAN ProxyBot Phone Home Traffic rev 4 2010-10-04
snort ET POLICY python.urllib User Agent Web Crawl rev 8 2010-10-04
snort ET TROJAN PlayMP3z.biz Related Spyware/Trojan Install Report rev 3 2010-10-04
snort ET POLICY Orkut.com Social Site Access rev 4 2010-10-04
snort ET POLICY Possible ProxyShell Hide IP Installation file download rev 3 2010-10-04
snort ET POLICY Possible ProxyShell Anonymous Access Connection rev 3 2010-10-04
snort ET SCAN Tomcat upload from external source rev 5 2010-10-04
snort ET P2P Tor Get Server Request rev 5 2010-10-04
snort ET POLICY Myspace Login Attempt rev 6 2010-10-04
snort ET POLICY External Unencrypted Connection to Ossec WUI rev 3 2010-10-04
snort ET TROJAN Knockbot Proxy Checkin rev 3 2010-10-04
snort ET TROJAN Win32/FakeXPA Checkin URL rev 5 2010-10-04
snort ET TROJAN Pushdo Update URL Detected rev 9 2010-10-04
snort ET TROJAN Possible Infection Report Mail - Indy Mail lib and No Message Body - Priority 3 rev 8 2010-10-03
snort ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id DELETE rev 6 2010-10-03
snort ET WEB_SPECIFIC_APPS WSPortal SQL Injection Attempt -- content.php page DELETE rev 6 2010-10-03
snort ET TROJAN Gozi check-in / update rev 4 2010-10-03
snort ET WEB_SPECIFIC_APPS WSPortal SQL Injection Attempt -- content.php page INSERT rev 6 2010-10-03
snort ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id UPDATE rev 6 2010-10-03
snort ET POLICY ICP Email Send via HTTP - Often Trojan Install Reports rev 3 2010-10-03
snort ET WEB_SPECIFIC_APPS WSN Guest search.php search parameter SQL Injection rev 4 2010-10-03
snort ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id UNION SELECT rev 6 2010-10-03
snort ET TROJAN Win32.Lager Trojan Initial Checkin rev 4 2010-10-03
snort ET P2P Tor Get Status Request rev 3 2010-10-03
snort ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id SELECT rev 6 2010-10-03
snort ET TROJAN SpamTool.Win32.Agent.gy/Grum/Tedroo Or Similar HTTP Checkin rev 4 2010-10-03
snort ET TROJAN Hupigon URL Infection Checkin Detected rev 6 2010-10-03
snort ET TROJAN Win32.Lager Trojan Reporting rev 4 2010-10-03
snort ET TROJAN Haxdoor Reporting User Activity rev 8 2010-10-03
snort ET WEB_SPECIFIC_APPS WSPortal SQL Injection Attempt -- content.php page UPDATE rev 6 2010-10-03
snort ET TROJAN Possible Infection Report Mail - Indy Mail lib and No Message Body - Priority 1 rev 8 2010-10-03
snort ET CHAT Google IM traffic Jabber client sign-on rev 5 2010-10-03
snort ET WEB_SPECIFIC_APPS WSPortal SQL Injection Attempt -- content.php page SELECT rev 6 2010-10-03
snort ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id INSERT rev 6 2010-10-03
snort ET WEB_SPECIFIC_APPS WSPortal SQL Injection Attempt -- content.php page UNION SELECT rev 6 2010-10-03
snort ET WEB_SPECIFIC_APPS Website Designs For Less Click N Print Coupons SQL Injection Attempt -- coupon_detail.asp key UPDATE rev 6 2010-10-02
snort ET WEB_SPECIFIC_APPS Website Designs For Less Click N Print Coupons SQL Injection Attempt -- coupon_detail.asp key UNION SELECT rev 6 2010-10-02