Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET WEB_SERVER WebShell - zecmd - Form rev 3 2024-03-13
suricata ET MALWARE Possible WEBC2-GREENCAT Response - Embedded CnC APT1 Related rev 4 2024-03-13
suricata ET ACTIVEX Quest Explain Plan Display ActiveX Control SaveToFile Insecure Method Access rev 4 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdExport Method Access Buffer Overflow rev 5 2024-03-13
suricata ET MALWARE SolarBot Plugin Download Server Response rev 6 2024-03-13
suricata ET MALWARE CommentCrew Possible APT c2 communications download client.png rev 5 2024-03-13
suricata ET EXPLOIT_KIT DRIVEBY FlashPack Plugin-Detect May 13 2014 rev 3 2024-03-13
suricata ET SHELLCODE Possible Backslash Escaped UTF-8 0c0c Heap Spray rev 3 2024-03-13
suricata ET EXPLOIT Possible 2012-1533 altjvm RCE via JNLP command injection rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - Symlink_Sa rev 3 2024-03-13
suricata ET HUNTING Suspicious Possible CollectGarbage in base64 1 rev 4 2024-03-13
suricata ET MOBILE_MALWARE Android.KorBanker Successful Fake Banking App Install CnC Server Acknowledgement rev 4 2024-03-13
suricata ET ACTIVEX Possible SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX Control Install3rdPartyComponent Method Buffer Overflow rev 5 2024-03-13
suricata ET MALWARE Hiloti/Mufanom CnC Response rev 4 2024-03-13
suricata ET MALWARE Possible Metasploit Java Payload rev 6 2024-03-13
suricata ET EXPLOIT_KIT Exploit Kit Delivering JAR Archive to Client rev 4 2024-03-13
suricata ET EXPLOIT_KIT JDB Exploit Kit Landing Page rev 7 2024-03-13
suricata ET EXPLOIT_KIT TDS Sutra - page redirecting to a SutraTDS rev 4 2024-03-13
suricata ET EXPLOIT_KIT Unknown_MM - Payload Download rev 3 2024-03-13
suricata ET ACTIVEX Possible Sony PC Companion CheckCompatibility method Stack-based Unicode Buffer Overload rev 4 2024-03-13
suricata ET ACTIVEX Possible Windows Live Writer ActiveX BlogThisLink Method Access Denail of Service Attack rev 6 2024-03-13
suricata ET WEB_SERVER WebShell - Generic - c99shell based header rev 3 2024-03-13
suricata ET WEB_CLIENT DRIVEBY Social Engineering Toolkit Web Clone code detected rev 3 2024-03-13
suricata ET MALWARE CommentCrew Possible APT c2 communications sleep3 rev 5 2024-03-13
suricata ET ACTIVEX Possible Ecava IntegraXor save method Remote ActiveX Buffer Overflow rev 4 2024-03-13
suricata ET MALWARE Win32/Enchanim Check-in Response rev 4 2024-03-13
suricata ET MALWARE DaoDao Cloud Loader C2 Response rev 1 2024-03-13
suricata ET MALWARE TA416 Related PUBLOAD Variant Checkin Activity M2 rev 1 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class file Accessing Security Manager rev 3 2024-03-13
suricata ET WEB_CLIENT Injected iframe leading to Redkit Jan 02 2013 rev 5 2024-03-13
suricata ET INFO JAVA - document.createElement applet rev 3 2024-03-13
suricata ET WEB_CLIENT JS Browser Based Ransomware rev 3 2024-03-13
suricata ET ACTIVEX Possible Chilkat Software FTP2 ActiveX Component GetFile Access Remote Code Execution 2 rev 5 2024-03-13
suricata ET EXPLOIT_KIT DRIVEBY Java Atomic Exploit Downloaded rev 7 2024-03-13
suricata ET WEB_SERVER WEBSHELL CFM Shell Access rev 3 2024-03-13
suricata ET ACTIVEX Tracker Software pdfSaver ActiveX StoreInRegistry Method Access Potential Buffer Overflow rev 5 2024-03-13
suricata ET WEB_SERVER WebShell Generic eval of str_rot13 rev 9 2024-03-13
suricata ET ACTIVEX Possible NET-i viewer ActiveX Control ConnectDDNS Method Access Code Execution Vulnerability 2 rev 7 2024-03-13
suricata ET WEB_CLIENT CookieBomb 2.0 In Server Response Jan 29 2014 rev 6 2024-03-13
suricata ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access getGalleryImage rev 5 2024-03-13