Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata GPL NETBIOS SMB llsrpc create tree attempt rev 5 2019-07-26
suricata GPL ICMP PING Microsoft Windows rev 8 2019-07-26
suricata ET SNMP Attempted UDP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String ILMI rev 2 2019-07-26
suricata ET WEB_CLIENT Microsoft Office Visio DXF File Processing Remote Code Execution rev 3 2019-07-26
suricata GPL SHELLCODE SGI NOOP rev 6 2019-07-26
suricata ET DOS Potential CLDAP Amplification Reflection rev 1 2019-07-26
suricata GPL SHELLCODE sparc NOOP rev 6 2019-07-26
suricata ET SNMP Attempted UDP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String cable-docsis rev 2 2019-07-26
suricata ET TFTP Outbound TFTP Data Transfer With Cisco Config 2 rev 2 2019-07-26
suricata ET P2P MS WUDO Peer Sync rev 1 2019-07-26
suricata GPL NETBIOS SMB NT Trans NT CREATE DACL overflow attempt rev 5 2019-07-26
suricata ET SCAN Smap VOIP Device Scan rev 5 2019-07-26
suricata ET TFTP Outbound TFTP Data Transfer with Cisco config rev 5 2019-07-26
suricata ET INFO SMB2 NT Create AndX Request For a .bat File rev 2 2019-07-26
suricata ET MALWARE Overtoolbar.net Backdoor ICMP Checkin Response rev 3 2019-07-26
suricata ET MALWARE Win32/Enchanim C2 Client Check-in rev 2 2019-07-26
suricata ET DOS MC-SQLR Response Outbound Possible DDoS Participation rev 4 2019-07-26
suricata GPL IMAP delete overflow attempt rev 2 2019-07-26
suricata GPL NETBIOS SMB-DS NDdeSetTrustedShareW unicode little endian overflow attempt rev 7 2019-07-26
suricata ET MALWARE ZeroAccess Outbound udp traffic detected rev 8 2019-07-26
suricata ET INFO Office Document Containing AutoExec Macro Via smtp rev 2 2019-07-26
suricata ET MALWARE [PTsecurity] Remcos RAT Checkin 69 rev 1 2019-07-26
suricata GPL RPC tooltalk UDP overflow attempt rev 9 2019-07-26
suricata GPL ICMP PING BeOS4.x rev 8 2019-07-26
suricata GPL IMAP auth overflow attempt rev 3 2019-07-26
suricata GPL NETBIOS SMB-DS IrotIsRunning attempt rev 5 2019-07-26
suricata ET INFO Google Talk TLS Client Traffic rev 4 2019-07-26
suricata GPL SHELLCODE x86 0x71FB7BAB NOOP rev 3 2019-07-26
suricata ET EXPLOIT Possible MySQL CVE-2016-6662 Attempt rev 1 2019-07-26
suricata GPL NETBIOS SMB-DS RemoteActivation little endian attempt rev 4 2019-07-26
suricata ET MALWARE Windows gpresult Microsoft Windows DOS prompt command exit OUTBOUND rev 1 2019-07-26
suricata ET SCAN Potential SSH Scan rev 20 2019-07-26
suricata ET SCAN NMAP SIP Version Detection Script Activity rev 1 2019-07-26
suricata ET P2P Vuze BT Connection rev 5 2019-07-26
suricata ET MALWARE Hawkeye Keylogger SMTP Beacon rev 3 2019-07-26
suricata ET MALWARE W32/Mentory CnC Server Providing Update Details rev 2 2019-07-26
suricata ET MALWARE W32/DoubleTap.APT Downloader CnC Beacon rev 2 2019-07-26
suricata ET MALWARE Win32/Bulta CnC Beacon rev 2 2019-07-26
suricata GPL SHELLCODE Linux shellcode rev 10 2019-07-26
suricata ET INFO Bitmessage Activity rev 2 2019-07-26