Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET WEB_SERVER Attempt To Access MSSQL xp_readerrorlogs Stored Procedure Via URI to View Error Logs rev 8 2020-09-14
suricata ET WEB_SERVER Tilde in URI - potential .asp source disclosure vulnerability rev 15 2020-09-14
suricata ET MALWARE Possible Dragonfly APT Activity HTTP URI OPTIONS rev 3 2020-09-14
suricata ET PHISHING Possible Successful Verified by Visa Phish Jan 30 2014 rev 6 2020-09-14
suricata ET WEB_SERVER Tilde in URI - potential .inc source disclosure vulnerability rev 15 2020-09-14
suricata ET WEB_SERVER Tilde in URI - potential .cgi source disclosure vulnerability rev 9 2020-09-14
suricata ET WEB_SERVER Tilde in URI - potential .conf source disclosure vulnerability rev 15 2020-09-14
suricata ET WEB_SPECIFIC_APPS AJ Classifieds SQL Injection Attempt -- postingdetails.php postingid UPDATE rev 9 2020-09-14
suricata ET WEB_SERVER Tilde in URI - potential .pl source disclosure vulnerability rev 15 2020-09-14
suricata ET WEB_SERVER SELECT INSTR in URI Possible ORACLE Related Blind SQL Injection Attempt rev 7 2020-09-14
suricata ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 3 rev 4 2020-09-14
suricata ET WEB_SPECIFIC_APPS Informacion General informacion_general.php DELETE FROM SQL Injection Attempt rev 7 2020-09-14
suricata ET HUNTING Suspicious User-Agent Containing .exe rev 16 2020-09-14
suricata ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup rev 7 2020-09-14
suricata ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 2 rev 4 2020-09-14
suricata ET SCAN bsqlbf Brute Force SQL Injection rev 7 2020-09-14
suricata ET P2P BTWebClient UA uTorrent in use rev 6 2020-09-14
suricata ET WEB_SERVER Attempt To Access MSSQL sp_adduser Stored Procedure Via URI to Create New Database User rev 8 2020-09-14
suricata ET WEB_SERVER Attempt To Access MSSQL xp_fileexist Stored Procedure Via URI to Locate Files On Disk rev 8 2020-09-14
suricata ET INFO WinHttp AutoProxy Request wpad.dat Possible BadTunnel rev 5 2020-09-14
suricata ET WEB_SERVER Possible Cisco PIX/ASA HTTP Web Interface HTTP Response Splitting Attempt rev 7 2020-09-14
suricata ET WEB_SPECIFIC_APPS Bexfront sid Parameter INSERT INTO SQL Injection Attempt rev 5 2020-09-13
suricata ET WEB_SPECIFIC_APPS T-Content Management System id_novedad Parameter DELETE FROM SQL Injection Attempt rev 5 2020-09-13
suricata ET WEB_SPECIFIC_APPS Woltlab Burning Board katid Parameter SELECT FROM SQL Injection Attempt rev 5 2020-09-13
suricata ET WEB_SPECIFIC_APPS IWantOneButton Wordpress SQL Injection Attempt updateAJAX.php post_id DELETE rev 5 2020-09-13
suricata ET WEB_SPECIFIC_APPS AJ Auction SQL Injection Attempt -- subcat.php cate_id INSERT rev 11 2020-09-13
suricata ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UPDATE rev 11 2020-09-13
suricata ET WEB_SPECIFIC_APPS AJ Auction SQL Injection Attempt -- subcat.php cate_id UPDATE rev 11 2020-09-13
suricata ET WEB_SPECIFIC_APPS AJ Classifieds SQL Injection Attempt -- postingdetails.php postingid SELECT rev 11 2020-09-13
suricata ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UNION SELECT rev 11 2020-09-13
suricata ET WEB_SPECIFIC_APPS IWantOneButton Wordpress SQL Injection Attempt updateAJAX.php post_id UNION SELECT rev 5 2020-09-13
suricata ET WEB_SPECIFIC_APPS IWantOneButton Wordpress SQL Injection Attempt updateAJAX.php post_id UPDATE rev 5 2020-09-13
suricata ET WEB_SPECIFIC_APPS AJ Auction SQL Injection Attempt -- subcat.php cate_id UNION SELECT rev 11 2020-09-13
suricata ET HUNTING SUSPICIOUS .exe Downloaded from SVN/HTTP on GoogleCode rev 4 2020-09-13
suricata ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id DELETE rev 11 2020-09-13
suricata ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id SELECT rev 11 2020-09-13
suricata ET WEB_SPECIFIC_APPS T-Content Management System id_novedad Parameter INSERT INTO SQL Injection Attempt rev 5 2020-09-13
suricata ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id INSERT rev 11 2020-09-13
suricata ET WEB_SPECIFIC_APPS AJ Auction SQL Injection Attempt -- subcat.php cate_id SELECT rev 11 2020-09-13
suricata ET WEB_SPECIFIC_APPS Woltlab Burning Board katid Parameter UPDATE SET SQL Injection Attempt rev 5 2020-09-13