Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CURRENT_EVENTS Successful Scotiabank Phish M1 May 24 2017 rev 1 2017-05-24
snort ET WEB_CLIENT Samsung Galaxy Knox Android Browser RCE smdm attempt rev 3 2017-05-24
snort ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 3 rev 4 2017-05-19
snort ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 rev 3 2017-05-18
snort ET TROJAN Agent Tesla Keylogger Report SMTP rev 2 2017-05-18
snort ET EXPLOIT NB8-04 - Possible Unauthed RCE via whitelist bypass rev 1 2017-05-17
snort ET TROJAN MWI Maldoc Load Payload rev 1 2017-05-17
snort ET EXPLOIT NB8-01 - Unauthed RCE via bprd rev 1 2017-05-17
snort ET TROJAN MWI Maldoc Posting Host Data rev 1 2017-05-17
snort ET EXPLOIT NB8-02 - Possible Unauthed RCE via nbbsdtar rev 1 2017-05-17
snort ET TROJAN Cobalt Strike Malleable C2 OCSP Profile rev 1 2017-05-15
snort ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan rev 8 2017-05-11
snort ET WEB_CLIENT PDF With Embedded Flash Possible Remote Code Execution Attempt rev 4 2017-05-11
snort ET SCAN Behavioral Unusual Port 1434 traffic Potential Scan or Infection rev 14 2017-05-11
snort ET TROJAN Poweliks Abnormal HTTP Headers high likelihood of Poweliks infection rev 3 2017-05-11
snort ET SCAN Multiple MySQL Login Failures Possible Brute Force Attempt rev 5 2017-05-11
snort ET TROJAN Snake rootkit usermode-centric encrypted command from server rev 2 2017-05-11
snort ET SCAN Behavioral Unusual Port 1433 traffic Potential Scan or Infection rev 15 2017-05-11
snort ET SCAN Suspicious User-Agent Containing Web Scan/er Likely Web Scanner rev 8 2017-05-11
snort ET WEB_SERVER SELECT INSTR in URI Possible ORACLE Related Blind SQL Injection Attempt rev 4 2017-05-11
snort ET SCAN Behavioral Unusual Port 135 traffic Potential Scan or Infection rev 14 2017-05-11
snort ET SCAN ICMP Delphi Likely Precursor to Scan rev 4 2017-05-11
snort ET SCAN Behavioral Unusual Port 137 traffic Potential Scan or Infection rev 14 2017-05-11
snort ET TROJAN Jaff Ransomware Checkin M1 rev 2 2017-05-11
snort ET TROJAN Jaff Ransomware Checkin rev 1 2017-05-11
snort ET WEB_SPECIFIC_APPS e107 CMS backdoor access admin-access cookie and HTTP POST rev 3 2017-05-11
snort ET TROJAN Suspicious Accept-Language HTTP Header zh-cn likely Kernelbot/Conficker Trojan Related rev 7 2017-05-11
snort ET SCAN ICMP @hello request Likely Precursor to Scan rev 4 2017-05-11
snort ET WEB_SERVER UA WordPress probable DDOS-Attack rev 3 2017-05-11
snort ET SCAN Suspicious User-Agent Containing SQL Inject/ion Likely SQL Injection Scanner rev 10 2017-05-11
snort ET WEB_SERVER Script tag in URI Possible Cross Site Scripting Attempt rev 9 2017-05-11
snort ET INFO Miniproxy Cloned Page - Possible Phishing Landing rev 1 2017-05-09
snort ET TROJAN Known Hostile Domain ant.trenz .pl Lookup rev 1 2017-05-08
snort ET WEB_SPECIFIC_APPS DevelopItEasy Photo Gallery photo_id parameter SQL Injection rev 5 2017-05-08
snort ET CURRENT_EVENTS Successful Apple Phish 2016-03-09 rev 2 2017-05-08
snort ET WEB_SPECIFIC_APPS DevelopItEasy Photo Gallery cat_id parameter SQL Injection rev 5 2017-05-08
snort ET ACTIVEX winhlp32 ActiveX control attack - phase 3 rev 13 2017-05-08
snort ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup rev 4 2017-05-08
snort ET ACTIVEX winhlp32 ActiveX control attack - phase 1 rev 15 2017-05-08
snort ET TROJAN MSIL/NewHT Ransomware CnC Checkin rev 1 2017-05-05