Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE W32/Echmark/MarkiRAT CnC Request rev 3 2024-04-12
suricata ET MALWARE W32/Syndicasec.Backdoor CnC Beacon rev 6 2024-04-12
suricata ET SCAN ZmEu exploit scanner rev 11 2024-04-12
suricata ET USER_AGENTS Ufasoft bitcoin Related User-Agent rev 7 2024-04-12
suricata ET MALWARE OLDBAIT Checkin sptr rev 5 2024-04-12
suricata ET INFO 2Downloadz.com File Sharing User-Agent rev 5 2024-04-12
suricata ET MALWARE Win32/Namsoth.A Checkin/NEWSREELS APT1 Related rev 5 2024-04-12
sigma Kubernetes Unauthorized or Unauthenticated Access test 2024-04-12
snort ET INFO Set flow on bmp file get rev 7 2024-04-11
snort ET CURRENT_EVENTS Privnote Landing Page 2024-04-11 rev 1 2024-04-11
snort ET SCAN ProxyReconBot CONNECT method to Mail rev 11 2024-04-11
suricata ET ADWARE_PUP Searchmiracle.com Spyware Installer silent.exe Download rev 14 2024-04-11
suricata ET ADWARE_PUP Webhancer Data Upload rev 13 2024-04-11
suricata ET HUNTING Set flow on bmp file get rev 10 2024-04-11
suricata ET ADWARE_PUP SpywareLabs VirtualBouncer Seeking Instructions rev 15 2024-04-11
suricata ET ADWARE_PUP PUP/PUA OSSProxy HTTP Header rev 15 2024-04-11
suricata ET PHISHING Privnote Landing Page 2024-04-11 rev 1 2024-04-11
suricata ET SCAN ProxyReconBot CONNECT method to Mail rev 10 2024-04-11
suricata ET WEB_SERVER MSSQL Server OLEDB asp error rev 14 2024-04-11
suricata ET WEB_CLIENT Encoded javascriptdocument.write - usually hostile rev 11 2024-04-11
suricata ET ATTACK_RESPONSE x2300 phpshell detected rev 9 2024-04-11
suricata ET ATTACK_RESPONSE r57 phpshell footer detected rev 10 2024-04-11
suricata ET ADWARE_PUP Webhancer Data Post rev 17 2024-04-11
suricata ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- aramayap.asp kelimeler DELETE rev 11 2024-04-11
snort ET TROJAN Possible Windows executable sent when remote host claims to send html content rev 11 2024-04-10
snort ET TROJAN Possible Windows executable sent when remote host claims to send HTML/CSS Content rev 7 2024-04-10
snort ET TROJAN Suspected Trojan-Proxy Web Socket Connection Activity rev 1 2024-04-10
suricata ET WEB_CLIENT VLC Media Player smb URI Handling Remote Buffer Overflow Attempt rev 7 2024-04-10
suricata ET WEB_SPECIFIC_APPS Ultrize TimeSheet timesheet.php include_dir Parameter Local File Inclusion rev 7 2024-04-10
suricata ET WEB_SPECIFIC_APPS X7 Chat mini.php help_file Parameter Local File Inclusion rev 8 2024-04-10
suricata ET ACTIVEX Possible AOL SuperBuddy ActiveX Control Remote Code Execution Attempt rev 9 2024-04-10
suricata ET WEB_SPECIFIC_APPS AdaptBB latestposts.php forumspath Parameter Local File Inclusion rev 11 2024-04-10
suricata ET WEB_SPECIFIC_APPS Blogplus block_left.php Local File Inclusion rev 9 2024-04-10
suricata ET WEB_SPECIFIC_APPS playSMS init.php apps_path themes parameter local file inclusion rev 8 2024-04-10
suricata ET WEB_SPECIFIC_APPS Acute Control Panel header.php theme_directory parameter local file inclusion rev 11 2024-04-10
suricata ET WEB_SPECIFIC_APPS LightOpenCMS smarty.php cwd Parameter Local File Inclusion rev 10 2024-04-10
suricata ET WEB_SPECIFIC_APPS Syntax Desktop preview.php synTarget Parameter Local File Inclusion rev 8 2024-04-10
suricata ET WEB_SPECIFIC_APPS QuickTeam qte_init.php qte_root Parameter Local File Inclusion rev 8 2024-04-10
suricata ET WEB_SPECIFIC_APPS Hedgehog CMS header.php c_temp_path Local File Inclusion rev 9 2024-04-10
suricata ET SCAN Wapiti Web Server Vulnerability Scan rev 11 2024-04-10