Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata GPL RPC STATD TCP monitor mon_name format string exploit attempt rev 11 2024-03-08
suricata GPL SMTP AUTH LOGON brute force attempt rev 4 2024-03-08
suricata GPL FTP SITE NEWER attempt rev 10 2024-03-08
suricata GPL FTP REST overflow attempt rev 8 2024-03-08
suricata GPL FTP passwd retrieval attempt rev 8 2024-03-08
suricata GPL NETBIOS DOS RFPoison rev 9 2024-03-08
suricata GPL RPC portmap rstatd request TCP rev 13 2024-03-08
suricata GPL FTP CWD .... attempt rev 6 2024-03-08
suricata GPL WEB_SERVER DELETE attempt rev 15 2024-03-08
suricata GPL EXPLOIT .htr access rev 18 2024-03-08
suricata GPL SNMP public access tcp rev 15 2024-03-08
suricata GPL SCAN nessus 2.x 404 probe rev 5 2024-03-08
suricata GPL FTP PORT bounce attempt rev 3 2024-03-08
suricata GPL SNMP private access tcp rev 13 2024-03-08
suricata GPL POP3 x86 SCO overflow rev 12 2024-03-08
suricata ET MALWARE Win32/RisePro CnC Server Response M3 rev 2 2024-03-08
suricata GPL EXPLOIT cmd32.exe access rev 6 2024-03-08
suricata GPL P2P eDonkey server response rev 5 2024-03-08
suricata GPL EXPLOIT xp_filelist attempt rev 8 2024-03-08
suricata GPL SMTP vrfy decode rev 11 2024-03-08
suricata ET WEB_SPECIFIC_APPS GL.iNet add_user API Request - Backdoor root User Attempt rev 2 2024-03-08
suricata GPL INFO Sun JavaServer default password login attempt rev 9 2024-03-08
suricata ET MALWARE Observed Malsmoke Staging Domain in SNI rev 2 2024-03-08
suricata GPL RPC portmap SET attempt TCP 111 rev 7 2024-03-08
suricata GPL RPC portmap proxy integer overflow attempt TCP rev 7 2024-03-08
suricata GPL SQL MSSQL shellcode attempt 2 rev 8 2024-03-08
suricata ET MALWARE RustyBuer CnC Domain in SNI rev 2 2024-03-08
suricata GPL RPC portmap amountd request TCP rev 13 2024-03-08
suricata ET PHISHING Observed OneDrive Phishing Landing Page 2021-08-09 rev 2 2024-03-08
suricata GPL POP3 AUTH overflow attempt rev 10 2024-03-08
suricata GPL WEB_SERVER Tomcat null byte directory listing attempt rev 9 2024-03-08
suricata GPL EXPLOIT ISAPI .ida access rev 15 2024-03-08
suricata GPL MISC rwhoisd format string attempt rev 8 2024-03-08
suricata GPL RPC portmap status request TCP rev 8 2024-03-08
suricata ET MALWARE Win32/Sefnit Initial Checkin rev 4 2024-03-08
suricata GPL MISC rlogin root rev 7 2024-03-08
suricata GPL WEB_SERVER printenv access rev 12 2024-03-08
suricata ET MOBILE_MALWARE Android.HongTouTou Checkin rev 4 2024-03-08
suricata GPL WEB_SERVER author.exe access rev 11 2024-03-08
suricata GPL P2P GNUTella client request rev 8 2024-03-08