Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata GPL MISC CVS invalid user authentication response rev 6 2024-03-08
suricata GPL NETBIOS SMB-DS DCERPC Remote Activation bind attempt rev 16 2024-03-08
suricata GPL WEB_SERVER 403 Forbidden rev 12 2024-03-08
suricata GPL NETBIOS xp_reg* - registry access rev 12 2024-03-08
suricata GPL FTP RNTO overflow attempt rev 9 2024-03-08
suricata ET PHISHING Phishing Landing Page - Excel Purchase Order Form rev 2 2024-03-08
suricata GPL RPC portmap nisd request TCP rev 13 2024-03-08
suricata GPL MISC rsh echo + + rev 7 2024-03-08
suricata GPL RPC portmap rexd request TCP rev 12 2024-03-08
suricata GPL POP3 POP3 PASS overflow attempt rev 16 2024-03-08
suricata GPL SQL sp_delete_alert log file deletion rev 7 2024-03-08
suricata ET EXPLOIT GoCD Authentication Bypass URI Path - add-on rev 2 2024-03-08
suricata GPL WEB_SERVER .htaccess access rev 10 2024-03-08
suricata GPL P2P BitTorrent transfer rev 4 2024-03-08
suricata GPL NETBIOS DCERPC invalid bind attempt rev 6 2024-03-08
suricata GPL NETBIOS SMB-DS DCERPC Messenger Service buffer overflow attempt rev 11 2024-03-08
suricata ET WEB_CLIENT Tech Support Scam - Generic Components rev 2 2024-03-08
suricata GPL MISC CVS missing cvsroot response rev 4 2024-03-08
suricata GPL CHAT Jabber/Google Talk Outgoing Traffic rev 4 2024-03-08
suricata GPL FTP MKD overflow rev 14 2024-03-08
suricata GPL RPC CMSD TCP CMSD_INSERT buffer overflow attempt rev 14 2024-03-08
suricata ET USER_AGENTS DanaBot Specific UA Observed rev 2 2024-03-08
suricata GPL EXPLOIT /msadc/samples/ access rev 12 2024-03-08
suricata GPL WEB_SERVER perl post attempt rev 8 2024-03-08
suricata GPL FTP DELE overflow attempt rev 10 2024-03-08
suricata GPL CHAT MSN user search rev 3 2024-03-08
suricata GPL FTP CMD overflow attempt rev 13 2024-03-08
suricata GPL SCAN nessus 1.X 404 probe rev 13 2024-03-08
suricata GPL NETBIOS SMB-DS DCERPC NTLMSSP invalid mechlistMIC attempt rev 13 2024-03-08
suricata GPL WEB_SERVER Tomcat null byte directory listing attempt rev 9 2024-03-08
suricata GPL CHAT Jabber/Google Talk Outoing Message rev 4 2024-03-08
suricata GPL RPC portmap listing TCP 111 rev 14 2024-03-08
suricata GPL MISC rwhoisd format string attempt rev 8 2024-03-08
suricata GPL RPC portmap yppasswd request TCP rev 12 2024-03-08
suricata ET PHISHING Observed Zimbra Phishing Landing Page 2021-08-09 rev 2 2024-03-08
suricata GPL POP3 AUTH overflow attempt rev 10 2024-03-08
suricata GPL CHAT Jabber/Google Talk Logon Success rev 4 2024-03-08
suricata GPL WEB_SERVER printenv access rev 12 2024-03-08
suricata ET WEB_SPECIFIC_APPS GL.iNet add_user API Request - Backdoor root User Attempt rev 2 2024-03-08
suricata GPL EXPLOIT ISAPI .idq attempt rev 18 2024-03-08