Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentwebsite DELETE rev 8 2020-04-17
suricata ET WEB_CLIENT Generic PHP Mailer Accessed on External Compromised Server rev 2 2020-04-17
suricata ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentwebsite UNION SELECT rev 8 2020-04-17
suricata ET WEB_SPECIFIC_APPS NetVIOS Portal SQL Injection Attempt -- page.asp NewsID UPDATE rev 9 2020-04-17
suricata ET WEB_SPECIFIC_APPS NetVIOS Portal SQL Injection Attempt -- page.asp NewsID DELETE rev 9 2020-04-17
suricata ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentname UPDATE rev 8 2020-04-17
suricata ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentwebsite SELECT rev 8 2020-04-17
suricata ET WEB_SERVER Generic PHP Mailer Accessed on Internal Compromised Server rev 2 2020-04-17
suricata ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2020-04-17
suricata ET WEB_SERVER Generic PHP Mailer Accessed on Internal Compromised Server rev 2 2020-04-17
suricata ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentmail DELETE rev 8 2020-04-17
suricata ET WEB_SPECIFIC_APPS NetVIOS Portal SQL Injection Attempt -- page.asp NewsID INSERT rev 10 2020-04-17
suricata ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentname DELETE rev 9 2020-04-17
suricata ET WEB_SPECIFIC_APPS NetClassifieds Premium Edition SQL Injection Attempt -- ViewCat.php s_user_id SELECT rev 9 2020-04-17
suricata ET WEB_SPECIFIC_APPS Neuron Blog SQL Injection Attempt -- addcomment2.php commentwebsite INSERT rev 8 2020-04-17
suricata ET WEB_CLIENT WSO 2.6 Webshell Accessed on External Compromised Server rev 2 2020-04-17
suricata ET WEB_SPECIFIC_APPS NetVIOS Portal SQL Injection Attempt -- page.asp NewsID UNION SELECT rev 9 2020-04-17
suricata ET WEB_CLIENT Generic PHP Mailer Accessed on External Compromised Server rev 2 2020-04-17
snort ET TROJAN AgentTesla Exfil via FTP rev 2 2020-04-16
snort ET TROJAN AgentTesla HTML System Info Report Exfil via FTP rev 1 2020-04-16
suricata ET MALWARE AgentTesla HTML System Info Report Exfil via FTP rev 1 2020-04-16
suricata ET MALWARE AgentTesla Exfil via FTP rev 1 2020-04-16
suricata ET MALWARE Suspected Zebrocy Implant CnC Checkin rev 2 2020-04-16
snort ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2020-04-15
snort ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2020-04-15
snort ET POLICY Observed DeepFreezeWeb User-Agent rev 2 2020-04-15
snort ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2020-04-15
snort ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2020-04-15
snort ET TROJAN ELF/Mirai Variant CnC Activity rev 1 2020-04-15
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2020-04-15
suricata ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server rev 2 2020-04-15
suricata ET MALWARE DNSG - Data Exfiltration via DNS rev 2 2020-04-15
suricata ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2020-04-15
suricata ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server rev 2 2020-04-15
snort ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server rev 2 2020-04-14
snort ET WEB_SERVER Leaf PHPMailer Accessed on Internal Server rev 2 2020-04-14
snort ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server rev 2 2020-04-14
snort ET TROJAN Observed DNS Query to Redkeeper Ransomware Domain rev 2 2020-04-14
snort ET WEB_CLIENT WSO Webshell Password Prompt Accessed on External Compromised Server rev 2 2020-04-14
snort ET WEB_SERVER WSO Webshell Password Prompt Accessed on Internal Compromised Server rev 2 2020-04-14