Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata GPL FTP XMKD overflow attempt rev 6 2024-03-08
suricata GPL RPC portmap kcms_server request TCP rev 12 2024-03-08
suricata ET INFO Powershell Base64 Decode Command Inbound rev 2 2024-03-08
suricata GPL NETBIOS SMB CD... rev 8 2024-03-08
suricata ET MOBILE_MALWARE Android.Trojan.AndroRAT.CE Checkin rev 3 2024-03-08
suricata GPL FTP SITE CHOWN overflow attempt rev 14 2024-03-08
suricata GPL P2P BitTorrent announce request rev 8 2024-03-08
suricata GPL EXPLOIT administrators.pwd access rev 11 2024-03-08
suricata GPL EXPLOIT Alternate Data streams ASP file access attempt rev 16 2024-03-08
suricata GPL RPC portmap rwalld request TCP rev 11 2024-03-08
suricata GPL FTP REST overflow attempt rev 8 2024-03-08
suricata GPL NETBIOS SMB CD.. rev 8 2024-03-08
suricata ET WEB_SERVER Common JSP WebShell String Observed in HTTP Header M3 rev 3 2024-03-08
suricata GPL FTP passwd retrieval attempt rev 8 2024-03-08
suricata GPL SQL sp_adduser - database user creation rev 7 2024-03-08
suricata ET MALWARE Known Skunkx DDOS Bot User-Agent Cyberdog rev 4 2024-03-08
suricata GPL SQL sp_password - password change rev 7 2024-03-08
suricata GPL WEB_SERVER services.cnf access rev 14 2024-03-08
suricata GPL EXPLOIT xp_cmdshell program execution 445 rev 7 2024-03-08
suricata ET MALWARE Win32/RisePro CnC Server Response M5 rev 3 2024-03-08
suricata GPL P2P GNUTella client request rev 8 2024-03-08
suricata GPL NETBIOS SMB DCERPC Workstation Service bind attempt rev 8 2024-03-08
suricata GPL SCAN nessus 1.X 404 probe rev 13 2024-03-08
suricata GPL SCAN adm scan rev 8 2024-03-08
suricata ET MALWARE Win32/Nitol.A CnC Checkin M3 rev 2 2024-03-08
suricata GPL FTP CWD ~<CR><NEWLINE> attempt rev 10 2024-03-08
suricata ET WEB_SPECIFIC_APPS GL.iNet add_user API Request - Backdoor root User Attempt rev 2 2024-03-08
suricata GPL RPC portmap listing TCP 111 rev 14 2024-03-08
suricata ET PHISHING Spox Phishkit Landing Page Inbound rev 2 2024-03-08
suricata ET MALWARE MoneroOcean Installer Batch Script Inbound rev 2 2024-03-08
suricata GPL SMTP EXPN overflow attempt rev 10 2024-03-08
suricata GPL RPC portmap espd request TCP rev 18 2024-03-08
suricata GPL RPC rlogin login failure rev 8 2024-03-08
suricata ET HUNTING Suspicious EXE requested with Java UA rev 3 2024-03-08
suricata ET MALWARE Stealbit Variant Data Exfil M1 rev 5 2024-03-08
suricata GPL EXPLOIT .cnf access rev 16 2024-03-08
suricata GPL SQL connect_data remote version detection attempt rev 7 2024-03-08
suricata GPL FTP ALLO overflow attempt rev 4 2024-03-08
suricata GPL TELNET Bad Login rev 11 2024-03-08
suricata GPL RPC portmap network-status-monitor request TCP rev 8 2024-03-08