Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata GPL FTP invalid MDTM command attempt rev 9 2024-03-08
suricata ET MALWARE ViperSoftX CnC Activity M1 rev 3 2024-03-08
suricata GPL WEB_SERVER services.cnf access rev 14 2024-03-08
suricata GPL SQL sp_adduser - database user creation rev 7 2024-03-08
suricata GPL RPC portmap ypserv request TCP rev 16 2024-03-08
suricata ET MALWARE Win32/FFDroider CnC Activity M2 rev 3 2024-03-08
suricata GPL RPC portmap rpc.xfsmd request TCP rev 11 2024-03-08
suricata GPL EXPLOIT ISAPI .ida attempt rev 15 2024-03-08
suricata GPL FTP MKD overflow attempt rev 12 2024-03-08
suricata ET MALWARE Observed 3CX Supply Chain Attack Cookie M2 rev 2 2024-03-08
suricata ET INFO Powershell Base64 Decode Command Inbound rev 2 2024-03-08
suricata ET MOBILE_MALWARE Android.Trojan.AndroRAT.CE Checkin rev 3 2024-03-08
suricata GPL RPC portmap snmpXdmi request TCP rev 20 2024-03-08
suricata GPL SQL sp_password - password change rev 7 2024-03-08
suricata GPL TELNET TELNET login failed rev 11 2024-03-08
suricata GPL NETBIOS xp_reg* - registry access rev 12 2024-03-08
suricata GPL SMTP vrfy root rev 8 2024-03-08
suricata GPL MISC rwhoisd format string attempt rev 8 2024-03-08
suricata ET WEB_SPECIFIC_APPS GL.iNet add_user API Request - Backdoor root User Attempt rev 2 2024-03-08
suricata GPL TELNET Bad Login rev 11 2024-03-08
suricata ET PHISHING Observed OneDrive Phishing Landing Page 2021-08-09 rev 2 2024-03-08
suricata GPL MISC HP Web JetAdmin file write attempt rev 3 2024-03-08
suricata GPL WEB_SERVER Tomcat null byte directory listing attempt rev 9 2024-03-08
suricata GPL RPC rlogin LinuxNIS rev 8 2024-03-08
suricata GPL P2P GNUTella client request rev 8 2024-03-08
suricata GPL EXPLOIT cmd32.exe access rev 6 2024-03-08
suricata GPL SQL MSSQL shellcode attempt 2 rev 8 2024-03-08
suricata ET MALWARE MoneroOcean Installer Batch Script Inbound rev 2 2024-03-08
suricata GPL RPC portmap amountd request TCP rev 13 2024-03-08
suricata GPL RPC portmap yppasswd request TCP rev 12 2024-03-08
suricata GPL P2P eDonkey server response rev 5 2024-03-08
suricata GPL CHAT Jabber/Google Talk Logon Success rev 4 2024-03-08
suricata GPL FTP STOU overflow attempt rev 6 2024-03-08
suricata GPL EXPLOIT .cnf access rev 16 2024-03-08
suricata ET WEB_CLIENT Tech Support Scam - Windows Firewall M4 2021-08-17 rev 2 2024-03-08
suricata ET HUNTING Suspicious EXE requested with Java UA rev 3 2024-03-08
suricata GPL RPC rlogin login failure rev 8 2024-03-08
suricata ET MOBILE_MALWARE Android.HongTouTou Checkin rev 4 2024-03-08
suricata ET MALWARE Observed Malsmoke Staging Domain in SNI rev 2 2024-03-08
suricata GPL NETBIOS SMB-DS DCERPC NTLMSSP invalid mechlistMIC attempt rev 13 2024-03-08