Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE RansomCrypt Getting Template rev 4 2024-03-06
suricata ET ACTIVEX Viscom Movie Player Pro SDK ActiveX DrawText method Buffer Overflow Function Call rev 3 2024-03-06
suricata ET WEB_SPECIFIC_APPS AvailScript Photo Album Script pics.php sid Parameter SQL Injection rev 8 2024-03-06
suricata ET WEB_SPECIFIC_APPS Hubscript PHPInfo Attempt rev 8 2024-03-06
suricata ET INFO Coral Web Proxy/Content Distribution Net Use rev 3 2024-03-06
suricata ET MALWARE ATTACKER IRCBot - reg - PRIVMSG Command rev 5 2024-03-06
suricata ET MALWARE Sourtoff Receiving Simda Payload rev 4 2024-03-06
suricata ET WEB_SPECIFIC_APPS GDL gdl.php node Parameter SQL Injection rev 8 2024-03-06
suricata ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA rev 9 2024-03-06
suricata ET MALWARE Shady RAT Retrieve and Execute Command rev 3 2024-03-06
suricata ET INFO Possible Firefox Plugin install rev 7 2024-03-06
suricata ET DOS Terse HTTP GET Likely GoodBye 5.2 DDoS tool rev 3 2024-03-06
suricata ET MALWARE Infostealer.Bancos Sending Stolen info SMTP rev 3 2024-03-06
suricata ET GAMES MINECRAFT Server response inbound rev 2 2024-03-06
suricata ET SCAN SQLNinja Attempt To Recreate xp_cmdshell Using sp_configure rev 6 2024-03-06
suricata ET INFO InstallIQ Updater Software request rev 5 2024-03-06
suricata ET EXPLOIT_KIT Bleeding Life 2 GPLed Exploit Pack exploit request rev 6 2024-03-06
suricata ET MALWARE Win32.Vilsel Checkin rev 4 2024-03-06
suricata ET EXPLOIT Tenda ADSL2/2+ Router DNS Change GET Request rev 5 2024-03-06
suricata ET SMTP Sorbs.net Block Message rev 3 2024-03-06
suricata ET SCAN Tomcat upload from external source rev 9 2024-03-06
suricata ET INFO HTTP Request to a *.uni.cc domain rev 6 2024-03-06
suricata ET P2P Libtorrent User-Agent rev 7 2024-03-06
suricata ET MALWARE Possible Passthru/Kshell Port Redirection Initiation rev 3 2024-03-06
suricata ET INFO HTTP Request to a *.qc.cx domain rev 5 2024-03-06
suricata ET WEB_SPECIFIC_APPS Plogger plog-download.php checked Parameter SQL Injection rev 7 2024-03-06
suricata ET MALWARE Possible Duqu 2.0 Accessing backdoor over 443 rev 3 2024-03-06
suricata ET INFO Unsupported/Fake Internet Explorer Version MSIE 2. rev 7 2024-03-06
suricata ET MALWARE ATTACKER IRCBot - net localgroup - PRIVMSG Command rev 5 2024-03-06
suricata ET WEB_SPECIFIC_APPS programsrating rate.php id XSS attempt rev 7 2024-03-06
suricata ET MALWARE Linux/dtool IRC Command Complete 3 rev 4 2024-03-06
suricata ET MALWARE ISRStealer Checkin rev 9 2024-03-06
suricata ET MALWARE Linux.Trojan.IptabLex Variant Checkin rev 2 2024-03-06
suricata ET EXPLOIT Apache Struts Possible OGNL AllowStaticMethodAccess in URI rev 5 2024-03-06
suricata ET MALWARE ATTACKER IRCBot - net user - PRIVMSG Command rev 5 2024-03-06
suricata ET MALWARE BlackEnergy v2.x Plugin Download Request rev 8 2024-03-06
suricata ET WEB_SPECIFIC_APPS ShopMaker product.php id Parameter Remote SQL Injection rev 7 2024-03-06
suricata ET MALWARE Snake rootkit usermode-centric encrypted command from server rev 5 2024-03-06
suricata ET WEB_SPECIFIC_APPS Harlandscripts Pro Traffic One mypage.php trg Parameter SQL Injection rev 8 2024-03-06
suricata ET WEB_SPECIFIC_APPS TurnkeyForms Business Survey Pro id parameter SQL Injection rev 7 2024-03-06