Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET WEB_CLIENT Microsoft Office RTF Stack Buffer Overflow rev 5 2015-03-18
snort ET DOS Bittorrent User-Agent inbound - possible DDOS rev 1 2015-03-18
snort ET TROJAN MWI Maldoc Exploit Kit Stats Callout rev 2 2015-03-18
snort ET WEB_SERVER Possible CVE-2015-1427 Elastic Search Sandbox Escape Remote Code Execution Attempt rev 2 2015-03-17
snort ET TROJAN US-CERT TA14-353A Lightweight Backdoor 10 rev 2 2015-03-16
snort ET TROJAN Tinba Checkin 3 rev 2 2015-03-14
snort ET TROJAN Ursnif Checkin rev 2 2015-03-12
snort ET TROJAN Gamarue/Andromeda Downloading Payload rev 1 2015-03-12
snort ET TROJAN Banker Boleto Fraud JS_BROBAN.SM Checkin 3 rev 2 2015-03-10
snort ET TROJAN Possible malicious Office doc hidden in XML file rev 1 2015-03-10
snort ET POLICY Pandora Usage rev 2 2015-03-07
snort ET CURRENT_EVENTS Unknown Malicious Second Stage Download URI Struct M2 Feb 06 2015 rev 1 2015-03-07
snort ET TROJAN LogPOS Sending Data rev 1 2015-03-04
snort ET EXPLOIT Seagate Business NAS Unauthenticated Remote Command Execution rev 2 2015-03-04
snort ET EXPLOIT PCMan FTP Server 2.0.7 Remote Command Execution rev 2 2015-03-03
snort ET POLICY Privdog Activation rev 1 2015-02-27
snort ET POLICY Privdog Update check rev 1 2015-02-27
snort ET WEB_SERVER WebShell - ASPyder - File Create - POST Structure rev 3 2015-02-26
snort ET TROJAN Unknown Trojan Downloading PE via MSSQL Connection to Non-Standard Port rev 1 2015-02-25
snort ET WEB_SERVER ATTACKER WebShell - Weevely - Cookie rev 1 2015-02-24
snort ET TROJAN SuperFish CnC Beacon 1 rev 1 2015-02-20
snort ET TROJAN Likely Arid Viper APT Advtravel Campaign GET Keepalive rev 4 2015-02-20
snort ET CURRENT_EVENTS KaiXin Landing M3 rev 2 2015-02-20
snort ET TROJAN Carbanak APT CnC Beacon 1 rev 2 2015-02-20
snort ET TROJAN SuperFish CnC Beacon 2 rev 2 2015-02-20
snort ET TROJAN Likely Arid Viper APT Advtravel Campaign POST rev 4 2015-02-20
snort ET CURRENT_EVENTS KaiXin Secondary Landing Page M2 rev 2 2015-02-20
snort ET EXPLOIT Possible dlink-DSL2640B DNS Change Attempt rev 1 2015-02-19
snort ET EXPLOIT Generic ADSL Router DNS Change GET Request rev 1 2015-02-19
snort ET CURRENT_EVENTS DRIVEBY GENERIC ShellExecute in Hex No Seps rev 1 2015-02-19
snort ET TROJAN Possible Babar POST Request rev 1 2015-02-19
snort ET CURRENT_EVENTS DRIVEBY GENERIC CollectGarbage in Hex String No Seps rev 1 2015-02-19
snort ET EXPLOIT Possible ShuttleTech 915WM DNS Change Attempt rev 1 2015-02-19
snort ET EXPLOIT Generic ADSL Router DNS Change POST Request rev 1 2015-02-19
snort ET CURRENT_EVENTS DRIVEBY GENERIC ShellExecute in URLENCODE rev 1 2015-02-19
snort ET TROJAN Win32.Beaugrit.gen.AAAA rev 1 2015-02-19
snort ET CURRENT_EVENTS Possible CVE-2014-6332 DECS2 rev 2 2015-02-18
snort ET TROJAN Arid Viper APT Transmitting Date rev 1 2015-02-17
snort ET TROJAN Arid Viper APT Checkin 2 rev 1 2015-02-17
snort ET TROJAN Arid Viper APT Checking filename rev 1 2015-02-17