Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET WORM W32/Njw0rm CnC Beacon rev 3 2013-08-31
snort ET WEB_SERVER WebShell Generic eval of str_rot13 rev 6 2013-08-31
snort ET P2P eMule KAD Network Connection Request rev 5 2013-08-30
snort ET WEB_SERVER WebShell - ASPyder - File Browser - Interface rev 2 2013-08-28
snort ET WEB_SERVER WebShell - ASPyder - Auth Prompt rev 1 2013-08-28
snort ET WEB_SERVER WebShell - ASPyder - File Browser - POST Structure rev 1 2013-08-28
snort ET TROJAN Possible APT-12 Related C2 rev 1 2013-08-28
snort ET WEB_SERVER WebShell - ASPyder -File Upload - POST Structure rev 1 2013-08-28
snort ET WEB_SERVER WebShell - ASPyder - File Upload - Response rev 1 2013-08-28
snort ET TROJAN Bitcoin variant Checkin rev 1 2013-08-23
snort ET TROJAN Mashigoom/Tranwos/RevProxy ClickFraud - hello rev 6 2013-08-22
snort ET TROJAN Possible Win32/Napolar.A URL Response rev 1 2013-08-22
snort ET INFO InetSim Response from External Source Possible SinkHole rev 1 2013-08-21
snort ET TROJAN Trojan Related Lame Updater User-Agent rev 3 2013-08-21
snort ET TROJAN Win32.Troj.Cidox Checkin rev 2 2013-08-21
snort ET TROJAN Proxychecker Lookup rev 2 2013-08-20
snort ET TROJAN Trojan.APT.9002 CnC Traffic rev 8 2013-08-20
snort ET SHELLCODE Possible UTF-16 %u9090 NOP SLED rev 3 2013-08-19
snort ET TROJAN Optix Pro Trojan/Keylogger Reporting Installation via Email rev 5 2013-08-19
snort ET TROJAN DarkComet-RAT server join acknowledgement rev 3 2013-08-19
snort ET TROJAN W32/Spy.KeyLogger.OCI CnC Checkin rev 1 2013-08-19
snort ET SHELLCODE Possible UTF-16 u9090 NOP SLED rev 3 2013-08-19
snort ET TROJAN ATTACKER IRCBot - PRIVMSG Response - net command output rev 5 2013-08-16
snort ET TROJAN ATTACKER IRCBot - ipconfig - PRIVMSG Command rev 4 2013-08-16
snort ET TROJAN ATTACKER IRCBot - netsh - PRIVMSG Command rev 4 2013-08-16
snort ET TROJAN ATTACKER IRCBot - net user - PRIVMSG Command rev 4 2013-08-16
snort ET TROJAN ATTACKER IRCBot - PRIVMSG Response - Directory Listing *nix rev 5 2013-08-16
snort ET TROJAN ATTACKER IRCBot - PRIVMSG Response - Directory Listing rev 3 2013-08-16
snort ET WEB_SERVER Possible Attempt to Get SQL Server Version in URI using SELECT VERSION rev 5 2013-08-16
snort ET TROJAN ATTACKER IRCBot - The command completed successfully - PRIVMSG Response rev 4 2013-08-16
snort ET TROJAN ATTACKER IRCBot - net localgroup - PRIVMSG Command rev 4 2013-08-16
snort ET TROJAN ATTACKER IRCBot - PRIVMSG Response - ipconfig command output rev 4 2013-08-16
snort ET TROJAN ATTACKER IRCBot - reg - PRIVMSG Command rev 4 2013-08-16
snort ET TROJAN ATTACKER IRCBot - net add PRIVMSG Command rev 4 2013-08-16
snort ET INFO SUSPICIOUS Reassigned Eval Function 2 rev 2 2013-08-15
snort ET POLICY Pirate Browser Download rev 1 2013-08-15
snort ET INFO SUSPICIOUS Reassigned Eval Function 3 rev 2 2013-08-15
snort ET INFO SUSPICIOUS IRC - NICK and 3 Letter Country Code rev 6 2013-08-14
snort ET TROJAN SUSPICIOUS IRC - NICK and Win rev 4 2013-08-14
snort ET TROJAN Sinowal/sinonet/mebroot/Torpig infected host checkin rev 9 2013-08-14