Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET INFO SUSPICIOUS UA starting with Mozilla/7 rev 1 2013-04-02
snort ET TROJAN Win32/Delfinject Check-in rev 2 2013-03-28
snort ET WEB_SERVER WebShell - JSPCMD - Form rev 1 2013-03-27
snort ET WEB_SERVER WebShell Generic - reg HKEY_LOCAL_MACHINE rev 1 2013-03-27
snort ET WEB_SERVER WebShell Generic - netsh firewall rev 1 2013-03-27
snort ET WEB_SERVER WebShell - Simple - Title rev 1 2013-03-27
snort ET WEB_SERVER WebShell Generic - wget http - POST rev 1 2013-03-27
snort ET WEB_SERVER LOIC Javascript DDoS Inbound rev 4 2013-03-25
snort ET TROJAN [CrowdStrike] ANCHOR PANDA Torn RAT Beacon Message rev 2 2013-03-23
snort ET TROJAN [CrowdStrike] ANCHOR PANDA - Adobe Gh0st Beacon rev 2 2013-03-23
snort ET TROJAN [CrowdStrike] ANCHOR PANDA Torn RAT Beacon Message Header Local rev 2 2013-03-23
snort ET TROJAN Galock Ransomware Command rev 1 2013-03-22
snort ET TROJAN Galock Ransomware Check-in rev 1 2013-03-22
snort ET WEB_SERVER Possible Perl Shell in HTTP POST rev 5 2013-03-22
snort ET CURRENT_EVENTS Watering Hole applet name AppletHigh.jar rev 1 2013-03-22
snort ET WEB_SERVER Possible Perl Shell in HTTP POST rev 5 2013-03-22
snort ET WEB_SERVER PHP tags in HTTP POST rev 4 2013-03-22
snort ET MOBILE_MALWARE Android/GoldDream Infected Device Registration rev 3 2013-03-20
snort ET TROJAN Backdoor.Win32.Xtrat Checkin 2 rev 4 2013-03-20
snort ET TROJAN RevProxy Java Settings rev 3 2013-03-19
snort GPL RPC portmap rexd request TCP rev 11 2013-03-18
snort GPL RPC portmap nisd request TCP rev 12 2013-03-18
snort GPL RPC portmap cmsd request TCP rev 10 2013-03-18
snort GPL RPC portmap amountd request TCP rev 12 2013-03-18
snort GPL RPC portmap yppasswd request TCP rev 11 2013-03-18
snort GPL RPC portmap ypserv request TCP rev 15 2013-03-18
snort GPL RPC portmap pcnfsd request TCP rev 13 2013-03-18
snort GPL RPC portmap rusers request TCP rev 15 2013-03-18
snort GPL RPC portmap admind request TCP rev 10 2013-03-18
snort GPL RPC portmap selection_svc request TCP rev 11 2013-03-18
snort GPL RPC portmap rstatd request TCP rev 12 2013-03-18
snort GPL RPC portmap bootparam request TCP rev 14 2013-03-18
snort GPL POP3 APOP USER overflow attempt rev 2 2013-03-18
snort GPL NETBIOS RFParalyze Attempt rev 10 2013-03-18
snort GPL RPC portmap sadmind request TCP rev 11 2013-03-18
snort ET DNS APT_NGO_wuaclt C2 Domain micorsofts.com rev 2 2013-03-15
snort ET TROJAN APT_NGO_wuaclt PDF file rev 1 2013-03-15
snort ET CURRENT_EVENTS Redkit Landing Page URL March 03 2013 rev 5 2013-03-15
snort ET TROJAN APT_NGO_wuaclt C2 Check-in rev 1 2013-03-14
snort ET WEB_SERVER WebShell - MySQL Interface - Database List rev 1 2013-03-14