Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Obitel Downloader Request rev 9 2024-04-10
suricata ET WEB_SPECIFIC_APPS Blogplus block_center_top.php Local File Inclusion rev 9 2024-04-10
suricata ET WEB_SPECIFIC_APPS Cyberfolio css.php theme Parameter Local File Inclusion rev 9 2024-04-10
snort ET TROJAN Potential Blackhole Exploit Pack Binary Load Request rev 11 2024-04-09
snort ET SHELLCODE Possible Unescape Encoded Content With Split String Obfuscation 2 rev 2 2024-04-09
snort ET POLICY Executable served from Amazon S3 rev 6 2024-04-09
snort ET SCAN libwww-perl GET to // with specific HTTP header ordering without libwww-perl User-Agent rev 7 2024-04-09
snort ET WEB_CLIENT PDF With Embedded Adobe Shockwave Flash Possibly Related to Remote Code Execution Attempt rev 5 2024-04-09
snort ET TROJAN TDSS/TDL/Alureon MBR rootkit Checkin rev 19 2024-04-09
snort ET TROJAN Zeus Bot Connectivity Check rev 22 2024-04-09
snort ET WEB_CLIENT PDF With Adobe Audition Session File Handling Buffer Overflow Flowbit Set rev 2 2024-04-09
snort ET SHELLCODE Possible Unescape Encoded Content With Split String Obfuscation rev 2 2024-04-09
snort ET SHELLCODE Unescape Variable Unicode Shellcode rev 2 2024-04-09
suricata ET MALWARE Win32/Winshow User Agent rev 4 2024-04-09
suricata ET MALWARE Spy Banker Outbound Communication Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS Joomla XGallery com_xgallery Component Local File Inclusion Attempt rev 6 2024-04-09
suricata ET SHELLCODE Common %0c%0c%0c%0c Heap Spray String rev 5 2024-04-09
suricata ET WEB_CLIENT Oracle Java 6 Object Tag launchjnlp docbase Parameters Buffer Overflow rev 8 2024-04-09
suricata ET ACTIVEX CygniCon CyViewer ActiveX Control SaveData Insecure Method Vulnerability rev 4 2024-04-09
suricata ET SHELLCODE Possible %u0d0d%u0d0d UTF-16 Heap Spray Attempt rev 4 2024-04-09
suricata ET ACTIVEX Avaya CallPilot Unified Messaging ActiveX Function Call rev 6 2024-04-09
suricata ET WEB_SERVER HTTP 414 Request URI Too Large rev 4 2024-04-09
suricata ET SHELLCODE Possible %u0d%u0d%u0d%u0d UTF-8 Heap Spray Attempt rev 4 2024-04-09
suricata ET WEB_SPECIFIC_APPS bug_actiongroup_page.php script Local File Inclusion Attempt rev 5 2024-04-09
suricata ET USER_AGENTS Suspicious Win32 User Agent rev 7 2024-04-09
suricata ET SHELLCODE Common %u0c0c%u0c0c UTF-16 Heap Spray String rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS WordPress XCloner Plugin cloner.cron.php config Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS Plogger phpThumb.php src Parameter Remote File Disclosure Attempt rev 6 2024-04-09
suricata ET WEB_SPECIFIC_APPS jQuery Mega Menu Wordpress Plugin Local File Inclusion Attempt rev 6 2024-04-09
suricata ET HUNTING EXE Using Suspicious IAT ZwUnmapViewOfSection Possible Malware Process Hollowing rev 9 2024-04-09
suricata ET WEB_CLIENT Adobe Authplay.dll NewClass Memory Corruption Attempt rev 5 2024-04-09
suricata ET WEB_CLIENT Adobe Shockwave Director tSAC Chunk memory corruption Attempt rev 6 2024-04-09
suricata ET ACTIVEX AVTECH Software ActiveX _DownloadPBControl Method Buffer Overflow Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS MaticMarket modulename Parameter Local File Inclusion Attempt-5 rev 6 2024-04-09
suricata ET INFO Java EXE Download rev 11 2024-04-09
suricata ET WEB_SPECIFIC_APPS The Uploader download_launch.php Remote File Disclosure Attempt rev 6 2024-04-09
suricata ET ACTIVEX AVTECH Software ActiveX Login Method Buffer Oveflow Attempt rev 5 2024-04-09
suricata ET ACTIVEX Tom Sawyer Possible Memory Corruption Attempt Format String Function Call rev 4 2024-04-09
suricata ET WEB_CLIENT FakeAV scanner page encountered Initializing Virus Protection System rev 5 2024-04-09
suricata ET ACTIVEX Chilkat Crypt ActiveX Control SaveDecrypted Insecure Method Vulnerability rev 5 2024-04-09