Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET WEB_CLIENT Blatantly Evil JS Function rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Lang Runtime in Response rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - Symlink_Sa rev 3 2024-03-13
suricata ET HUNTING PDF Containing Subform with JavaScript rev 7 2024-03-13
suricata ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access registerMicListener rev 4 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdExport Method Access Buffer Overflow rev 5 2024-03-13
suricata ET MALWARE Drive Receiving POST2 DDoS instructions rev 4 2024-03-13
suricata ET MALWARE Hoic.zip retrieval rev 4 2024-03-13
suricata ET MALWARE WEBC2-UGX Embedded CnC Response APT1 rev 3 2024-03-13
suricata ET ACTIVEX Possible Ecava IntegraXor save method Remote ActiveX Buffer Overflow rev 4 2024-03-13
suricata ET WEB_SERVER WebShell ASPXShell - Title rev 6 2024-03-13
suricata ET WEB_SERVER Possible Encrypted Webshell Download rev 5 2024-03-13
suricata ET EXPLOIT_KIT Exploit Kit Delivering JAR Archive to Client rev 4 2024-03-13
suricata ET INFO JAVA - Java Archive Download rev 10 2024-03-13
suricata ET EXPLOIT_KIT Lucky7 EK Landing Encoded Plugin-Detect rev 3 2024-03-13
suricata ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access sendSMS rev 4 2024-03-13
suricata ET MALWARE Darkness DDoS HTTP Target/EXE rev 8 2024-03-13
suricata ET EXPLOIT Metasploit js_property_spray sprayHeap rev 4 2024-03-13
suricata ET MALWARE CommentCrew Possible APT c2 communications sleep5 rev 5 2024-03-13
suricata ET EXPLOIT_KIT Possible WhiteLotus EK 2013-2551 Exploit 1 rev 5 2024-03-13
suricata ET ACTIVEX Possible Chilkat Software FTP2 ActiveX Component GetFile Access Remote Code Execution rev 6 2024-03-13
suricata ET MALWARE Tinba Server Response rev 5 2024-03-13
suricata ET MALWARE Pony Downloader check-in response STATUS-IMPORT-OK rev 4 2024-03-13
suricata ET EXPLOIT_KIT JDB Exploit Kit Landing Page rev 7 2024-03-13
suricata ET EXPLOIT_KIT TDS Sutra - page redirecting to a SutraTDS rev 4 2024-03-13
suricata ET ACTIVEX Possible SkinCrafter ActiveX Control InitLicenKeys Method Access Buffer Overflow rev 6 2024-03-13
suricata ET WEB_SERVER WebShell - D.K - Title rev 3 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Importing jmx mbeanserver rev 3 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdImport Method Access Buffer Overflow rev 5 2024-03-13
suricata ET ACTIVEX Possible NET-i viewer ActiveX Control ConnectDDNS Method Access Code Execution Vulnerability rev 7 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated Eval String 7 rev 4 2024-03-13
suricata ET WEB_SERVER WebShell Generic eval of gzuncompress rev 9 2024-03-13
suricata ET PHISHING Apple Phishing Landing Jan 30 2014 rev 4 2024-03-13
suricata ET INFO Android Dalvik Executable File Download rev 3 2024-03-13
suricata ET MALWARE Drive Receiving IP DDoS instructions rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Accessing Importing glassfish rev 3 2024-03-13
suricata ET WEB_SERVER WebShell - MySQL Interface - Database List rev 3 2024-03-13
suricata ET EXPLOIT_KIT Sibhost Zip as Applet Archive July 08 2013 rev 6 2024-03-13
suricata ET MALWARE Possible Backdoor.Adwind Download rev 5 2024-03-13
suricata ET ACTIVEX Possible NVIDIA Install Application ActiveX Control AddPackages Unicode Buffer Overflow rev 4 2024-03-13