Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET ACTIVEX Possible IBM Lotus Quickr for Domino ActiveX control Attachment_Times Method Access buffer overflow Attempt rev 8 2024-03-13
suricata ET EXPLOIT_KIT Fiesta SilverLight Exploit Download rev 3 2024-03-13
suricata ET INFO Embedded Executable File in PDF - This Program Cannot Be Run in DOS Mode rev 8 2024-03-13
suricata ET SHELLCODE Possible UTF-16 u9090 NOP SLED rev 5 2024-03-13
suricata ET WEB_SERVER ATTACKER WebShell - Zehir4.asp - content rev 3 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdExport Method Access Buffer Overflow 2 rev 5 2024-03-13
suricata ET MALWARE WEBC2-ADSPACE Server Response rev 3 2024-03-13
suricata ET MALWARE Cryptmen FakAV page Title rev 3 2024-03-13
suricata ET WEB_SERVER WebShell - Generic - c99shell based header rev 4 2024-03-13
suricata ET EXPLOIT_KIT Lucky7 EK Landing Encoded Plugin-Detect rev 3 2024-03-13
suricata ET WEB_SERVER Possible Encrypted Webshell Download rev 5 2024-03-13
suricata ET ACTIVEX Possible SkinCrafter ActiveX Control InitLicenKeys Method Access Buffer Overflow rev 6 2024-03-13
suricata ET ACTIVEX Possible NET-i viewer ActiveX Control ConnectDDNS Method Access Code Execution Vulnerability rev 7 2024-03-13
suricata ET MALWARE Hoic.zip retrieval rev 4 2024-03-13
suricata ET EXPLOIT_KIT TDS Sutra - page redirecting to a SutraTDS rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS .PIF File Inside of Zip rev 6 2024-03-13
suricata ET ACTIVEX Possible Chilkat Software FTP2 ActiveX Component GetFile Access Remote Code Execution rev 6 2024-03-13
suricata ET EXPLOIT_KIT CritXPack Landing Page rev 3 2024-03-13
suricata ET EXPLOIT_KIT Possible WhiteLotus EK 2013-2551 Exploit 1 rev 5 2024-03-13
suricata ET ACTIVEX Possible Samsung Kies ActiveX PrepareSync method Buffer overflow rev 4 2024-03-13
suricata ET MALWARE Tinba Server Response rev 5 2024-03-13
suricata ET ACTIVEX Possible Ecava IntegraXor save method Remote ActiveX Buffer Overflow rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - Simple - Title rev 3 2024-03-13
suricata ET EXPLOIT_KIT Exploit Kit Delivering JAR Archive to Client rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - Generic - c99shell based header w/colons rev 4 2024-03-13
suricata ET MALWARE Pony Downloader check-in response STATUS-IMPORT-OK rev 4 2024-03-13
suricata ET MALWARE CommentCrew Possible APT c2 communications sleep5 rev 5 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class file Importing Protection Domain rev 3 2024-03-13
suricata ET WEB_SERVER WebShell - Unknown - self-kill rev 3 2024-03-13
suricata ET INFO JAVA - Java Archive Download rev 10 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdSave Method Access Buffer Overflow 2 rev 5 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdImport Method Access Buffer Overflow rev 5 2024-03-13
suricata ET MALWARE Win32/Spyder Sending Info to CnC rev 2 2024-03-13
sigma Imports Registry Key From a File test 2024-03-13
sigma Imports Registry Key From an ADS test 2024-03-13
sigma Rundll32 Internet Connection test 2024-03-13
sigma IIS Native-Code Module Command Line Installation test 2024-03-13
sigma Changing Existing Service ImagePath Value Via Reg.EXE test 2024-03-13
sigma Diskshadow Script Mode Execution test 2024-03-13
sigma Outbound Network Connection Initiated By Script Interpreter test 2024-03-13