Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET ATTACK_RESPONSE Obfuscated Eval String 5 rev 4 2024-03-13
suricata ET ACTIVEX Possible Sony PC Companion Load method Stack-based Unicode Buffer Overload SEH rev 4 2024-03-13
suricata ET MALWARE ShellBot.C retrieval rev 4 2024-03-13
suricata ET ACTIVEX Possible NVIDIA Install Application ActiveX Control AddPackages Unicode Buffer Overflow rev 4 2024-03-13
suricata ET EXPLOIT_KIT BegOpEK - Landing Page rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Hex Encoded Class file rev 3 2024-03-13
suricata ET MALWARE W32/GMUnpacker.Downloader Download Instructions Response From CnC rev 3 2024-03-13
suricata ET PHISHING Possible iTunes Phishing Landing - Title over non SSL rev 5 2024-03-13
suricata ET MALWARE Possible Metasploit Java Payload rev 6 2024-03-13
suricata ET INFO Embedded Executable File in PDF - This Program Cannot Be Run in DOS Mode rev 8 2024-03-13
suricata ET WEB_CLIENT Malicious iframe guessing router password 2 rev 4 2024-03-13
suricata ET SHELLCODE Possible UTF-16 u9090 NOP SLED rev 5 2024-03-13
suricata ET INFO JAVA - ClassID rev 3 2024-03-13
suricata ET ACTIVEX Tracker Software pdfSaver ActiveX StoreInRegistry Method Access Potential Buffer Overflow 2 rev 7 2024-03-13
suricata ET WEB_SERVER WebShell - Generic - c99shell based header rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - GODSpy - GODSpy title rev 4 2024-03-13
suricata ET MALWARE Drive Receiving IP2 DDoS instructions rev 5 2024-03-13
suricata ET WEB_SERVER WEBSHELL K-Shell/ZHC Shell 1.0/Aspx Shell Backdoor NetCat_Listener rev 3 2024-03-13
suricata ET ACTIVEX winhlp32 ActiveX control attack - phase 3 rev 16 2024-03-13
suricata ET ACTIVEX Possible NET-i viewer ActiveX Control BackupToAvi Method Access Buffer Overflow 2 rev 7 2024-03-13
suricata ET MALWARE WEBC2-ADSPACE Server Response rev 3 2024-03-13
suricata ET EXPLOIT_KIT DRIVEBY Java Rhino Scripting Engine Exploit Downloaded rev 6 2024-03-13
suricata ET MALWARE Cryptmen FakAV page Title rev 3 2024-03-13
suricata ET MALWARE DaoDao Cloud Loader C2 Response rev 1 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdImport Method Access Buffer Overflow rev 5 2024-03-13
suricata ET EXPLOIT_KIT Possible WhiteLotus EK 2013-2551 Exploit 3 rev 5 2024-03-13
suricata ET ACTIVEX Possible Chilkat Software FTP2 ActiveX Component GetFile Access Remote Code Execution rev 6 2024-03-13
suricata ET MALWARE TA416 Related PUBLOAD Variant Checkin Activity M2 rev 1 2024-03-13
suricata ET MALWARE Win32/Spyder Sending Info to CnC rev 2 2024-03-13
suricata ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access takeCameraPicture rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class file Accessing Security Manager rev 3 2024-03-13
suricata ET MALWARE Tinba Server Response rev 5 2024-03-13
suricata ET HUNTING SUSPICIOUS Reassigned Eval Function 3 rev 4 2024-03-13
suricata ET WEB_SERVER Possible Encrypted Webshell Download rev 5 2024-03-13
suricata ET EXPLOIT_KIT Lucky7 EK Landing Encoded Plugin-Detect rev 3 2024-03-13
suricata ET MALWARE Win32/Enchanim Check-in Response rev 4 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdSave Method Access Buffer Overflow 2 rev 5 2024-03-13
suricata ET WEB_SERVER WebShell - Unknown - self-kill rev 3 2024-03-13
suricata ET WEB_SERVER WebShell - Generic - c99shell based header rev 3 2024-03-13
suricata ET MALWARE Embedded Android Dalvik Executable File With Fake Windows Executable Header - Possible AV Bypass Attempt rev 4 2024-03-13