Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET WEB_SPECIFIC_APPS iGaming CMS loadplugin.php load Parameter Local File inclusion Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS Open Web Analytics owa_do Parameter Local File inclusion Attempt rev 6 2024-04-09
suricata ET WEB_SPECIFIC_APPS Horde type Parameter Local File Inclusion Attempt rev 6 2024-04-09
suricata ET WEB_SERVER HTTP 414 Request URI Too Large rev 4 2024-04-09
suricata ET MALWARE W32/NetShare User-Agent rev 5 2024-04-09
suricata ET WEB_CLIENT Hex Obfuscation of substr %u UTF-16 Encoding rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS WordPress XCloner Plugin cloner.cron.php config Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET SHELLCODE Common %0c%0c%0c%0c Heap Spray String rev 5 2024-04-09
suricata ET ACTIVEX LEADTOOLS Imaging LEADSmtp ActiveX SaveMessage Method Vulnerability rev 4 2024-04-09
suricata ET WEB_CLIENT PDF With Embedded Adobe Shockwave Flash Possibly Related to Remote Code Execution Attempt rev 7 2024-04-09
suricata ET SHELLCODE Common %u0c0c%u0c0c UTF-16 Heap Spray String rev 5 2024-04-09
suricata ET MALWARE Win32/TrojanDownloader.Chekafe.D User-Agent my_check_data On Off HTTP Port rev 4 2024-04-09
suricata ET WEB_SPECIFIC_APPS LightNEasy File Manager language Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET WEB_CLIENT Hex Obfuscation of substr % Encoding rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS PHP-Fusion maincore.php folder_level Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS Joomla Component com_jmsfileseller view Parameter Local File Inclusion Attempt rev 4 2024-04-09
suricata ET WEB_CLIENT Hex Obfuscation of Script Tag % Encoding rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS BaconMap updatelist.php filepath Local File Inclusion Attempt rev 5 2024-04-09
suricata ET USER_AGENTS Suspicious Win32 User Agent rev 7 2024-04-09
suricata ET WEB_SPECIFIC_APPS Joomla XGallery com_xgallery Component Local File Inclusion Attempt rev 6 2024-04-09
suricata ET WEB_CLIENT Adobe Audition Malformed Session File Buffer Overflow Attempt rev 3 2024-04-09
suricata ET WEB_CLIENT Hex Obfuscation of eval % Encoding rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS Dokeos and Chamilo open_document.php file Parameter File Disclosure Attempt rev 6 2024-04-09
suricata ET WEB_SPECIFIC_APPS jQuery Mega Menu Wordpress Plugin Local File Inclusion Attempt rev 6 2024-04-09
suricata ET SHELLCODE Hex Obfuscated JavaScript Heap Spray 0c0c0c0c rev 4 2024-04-09
snort ET POLICY Outdated Flash Version M1 rev 123 2024-04-08
snort ET TROJAN Common Upatre URI/Headers Struct rev 3 2024-04-08
snort ET TROJAN Sage Ransomware Checkin Primer rev 3 2024-04-08
snort ET TROJAN Possible Kelihos.F EXE Download Common Structure 2 rev 4 2024-04-08
snort ET TROJAN W32/Zbot.Variant CnC Response rev 4 2024-04-08
snort ET TROJAN Zberp receiving config via image file - SET rev 9 2024-04-08
snort ET TROJAN Possible Deep Panda User-Agent rev 3 2024-04-08
snort ET INFO EXE Download With Content Type Specified As Empty rev 4 2024-04-08
snort ET TROJAN Possible Dridex Download URI Struct with no referer rev 6 2024-04-08
snort ET INFO Anonymous File Sharing Service Domain in DNS Lookup rev 1 2024-04-08
snort ET TROJAN Mal/Ransom-CE Connectivity Check rev 4 2024-04-08
snort ET EXPLOIT Possible Misfortune Cookie - SET rev 2 2024-04-08
snort ET INFO Packed Executable Download rev 3 2024-04-08
snort ET CURRENT_EVENTS Possible Pony DLL Download rev 3 2024-04-08
snort ET DOS HOIC with booster outbound rev 3 2024-04-08