Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Importing mbeanserver Introspector rev 3 2024-03-13
suricata ET WEB_SERVER WebShell - MySQL Interface - Auth Prompt rev 3 2024-03-13
suricata ET INFO JAVA - ClassID rev 3 2024-03-13
suricata ET INFO JNLP embedded file rev 4 2024-03-13
suricata ET ACTIVEX Possible Honeywell Tema Remote Installer ActiveX DownloadFromURL method Remote Code Execution rev 4 2024-03-13
suricata ET EXPLOIT_KIT DRIVEBY Generic - Redirection to Kit - BrowserDetect with var stopit rev 6 2024-03-13
suricata ET INFO Android Dalvik Executable File Download rev 3 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Importing tracing Provider Factory rev 3 2024-03-13
suricata ET EXPLOIT_KIT DRIVEBY Styx - TDS - Redirect To Landing Page rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - Generic - GIF Header With HTML Form rev 6 2024-03-13
suricata ET ACTIVEX Possible LEADTOOLS ActiveX Raster Twain AppName Method Access Buffer Overflow 2 rev 5 2024-03-13
suricata ET WEB_SERVER WEBSHELL CFM Shell Access rev 3 2024-03-13
suricata ET SHELLCODE Possible Backslash Escaped UTF-8 0c0c Heap Spray rev 3 2024-03-13
suricata ET WEB_SERVER WebShell - Pouya - Pouya_Server Shell rev 3 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdExport Method Access Buffer Overflow rev 5 2024-03-13
suricata ET EXPLOIT_KIT Possible WhiteLotus EK 2013-2551 Exploit 2 rev 5 2024-03-13
suricata ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access registerMicListener rev 4 2024-03-13
suricata ET EXPLOIT Possible 2012-1533 altjvm RCE via JNLP command injection rev 4 2024-03-13
suricata ET MALWARE Drive Receiving POST2 DDoS instructions rev 4 2024-03-13
suricata ET WEB_CLIENT JS Browser Based Ransomware rev 3 2024-03-13
suricata ET MALWARE Hoic.zip retrieval rev 4 2024-03-13
suricata ET WEB_SERVER WebShell Generic eval of str_rot13 rev 9 2024-03-13
suricata ET MALWARE Possible WEBC2-GREENCAT Response - Embedded CnC APT1 Related rev 4 2024-03-13
suricata ET INFO JAVA - document.createElement applet rev 3 2024-03-13
suricata ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access getGalleryImage rev 5 2024-03-13
suricata ET ACTIVEX Quest Explain Plan Display ActiveX Control SaveToFile Insecure Method Access rev 4 2024-03-13
suricata ET MALWARE WEBC2-UGX Embedded CnC Response APT1 rev 3 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated JS - URL Encoded Unescape Function Call Inbound rev 5 2024-03-13
suricata ET MALWARE Galock Ransomware Command rev 4 2024-03-13
suricata ET HUNTING Suspicious Possible CollectGarbage in base64 2 rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS Crystalize Filter in Uncompressed Flash rev 3 2024-03-13
suricata ET HUNTING SUSPICIOUS Word DOCX with Many ActiveX Objects and Media rev 7 2024-03-13
suricata ET HUNTING Suspicious Possible CollectGarbage in base64 1 rev 4 2024-03-13
suricata ET WEB_SERVER WebShell Generic eval of gzuncompress rev 9 2024-03-13
suricata ET MALWARE Gimemo Ransomware Checkin rev 5 2024-03-13
suricata ET MALWARE CommentCrew Possible APT crabdance backdoor base64 head 2 rev 5 2024-03-13
suricata ET WEB_CLIENT Blatantly Evil JS Function rev 4 2024-03-13
suricata ET MALWARE W32/GMUnpacker.Downloader Download Instructions Response From CnC rev 3 2024-03-13
suricata ET WEB_SERVER WebShell - GODSpy - GOD Hacker rev 3 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Importing Classes used in awt exploits rev 3 2024-03-13