Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET ADWARE_PUP UBar Trojan/Adware Checkin 2 rev 6 2024-04-09
suricata ET ACTIVEX AoA Audio Extractor ActiveX Control Buffer Overflow Attempt rev 5 2024-04-09
suricata ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 2 rev 4 2024-04-09
suricata ET SHELLCODE Possible 0x0c0c0c0c Heap Spray Attempt rev 4 2024-04-09
suricata ET WEB_SPECIFIC_APPS Joomla XCloner Component cloner.cron.php config Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 1 rev 4 2024-04-09
suricata ET ACTIVEX AVTECH Software ActiveX _DownloadPBControl Method Buffer Overflow Attempt rev 5 2024-04-09
suricata ET WEB_CLIENT Adobe Authplay.dll NewClass Memory Corruption Attempt rev 5 2024-04-09
suricata ET WEB_CLIENT Hex Obfuscation of replace Javascript Function %u UTF-8 Encoding rev 6 2024-04-09
suricata ET WEB_CLIENT PDF Containing Windows Commands Downloaded rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS 724CMS section.php Module Parameter Local File inclusion Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS N-13 News default_login_language Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS Dolphin BxDolGzip.php file Disclosure Attempt rev 5 2024-04-09
suricata ET WEB_CLIENT Hex Obfuscation of replace Javascript Function %u UTF-16 Encoding rev 6 2024-04-09
suricata ET SHELLCODE Common %u0a0a%u0a0a UTF-16 Heap Spray String rev 5 2024-04-09
suricata ET SHELLCODE Possible %41%41%41%41 Heap Spray Attempt rev 4 2024-04-09
suricata ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 3 rev 4 2024-04-09
suricata ET WEB_CLIENT FakeAV scanner page encountered Initializing Virus Protection System rev 5 2024-04-09
suricata ET MALWARE W32/Hupigon.B User Agent TSDownload rev 4 2024-04-09
suricata ET WEB_SPECIFIC_APPS Simplis CMS download_file Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET WEB_CLIENT PDF With Adobe Audition Session File Handling Buffer Overflow Flowbit Set rev 4 2024-04-09
suricata ET WEB_CLIENT Possible Adobe Acrobat Reader Newclass Invalid Pointer Remote Code Execution Attempt rev 6 2024-04-09
suricata ET WEB_SPECIFIC_APPS LoCal Calendar System LIBDIR Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS ClanSphere CurrentFolder Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET ACTIVEX AVTECH Software ActiveX _DownloadPBOpen Method Buffer Overflow Attempt rev 5 2024-04-09
suricata ET ACTIVEX Microsoft DirectX 9 ActiveX Control Format String Function Call rev 6 2024-04-09
suricata ET WEB_SPECIFIC_APPS WordPress PHP Speedy Plugin page Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET ACTIVEX Microsoft DirectX 9 msvidctl.dll ActiveX Control Code Execution Attempt rev 9 2024-04-09
suricata ET WEB_CLIENT Hex Obfuscation of eval %u UTF-16 Encoding rev 5 2024-04-09
suricata ET ACTIVEX Gesytec ElonFmt ActiveX Component Format String Function Call rev 4 2024-04-09
suricata ET ACTIVEX Cisco AnyConnect VPN Secure Mobility Client Cisco.AnyConnect.VPNWeb.1 Arbitrary Program Execution Attempt rev 5 2024-04-09
suricata ET MALWARE GET to Google with specific HTTP lib likely Cycbot/Bifrose/Kryptic checking Internet connection rev 8 2024-04-09
suricata ET WEB_SPECIFIC_APPS iGaming CMS loadplugin.php load Parameter Local File inclusion Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS Open Web Analytics owa_do Parameter Local File inclusion Attempt rev 6 2024-04-09
suricata ET WEB_CLIENT Adobe Acrobat Reader FlateDecode Stream Predictor Exploit Attempt rev 4 2024-04-09
suricata ET SHELLCODE Double BackSlash Hex Obfuscated JavaScript Heap Spray 0b0b0b0b rev 4 2024-04-09
suricata ET WEB_SPECIFIC_APPS WeBid active_auctions.php lan Parameter Local File inclusion Attempt rev 6 2024-04-09
suricata ET MALWARE Winsoft.E Checkin 3 rev 4 2024-04-09
suricata ET SHELLCODE Possible %u4141%u4141 UTF-16 Heap Spray Attempt rev 4 2024-04-09
suricata ET ACTIVEX AVTECH Software ActiveX _DownloadPBClose Method Buffer Overflow Attempt rev 5 2024-04-09