Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET WEB_SPECIFIC_APPS MindTouch Deki Wiki deki_plugin.php Local File Inclusion Attempt rev 2 2012-08-20
snort ET WEB_SPECIFIC_APPS MindTouch Deki Wiki wgDekiPluginPath parameter Local File Inclusion Attempt rev 2 2012-08-20
snort ET POLICY libwww-perl User-Agent rev 2 2012-08-20
snort ET TROJAN Farfli HTTP Checkin Activity rev 6 2012-08-17
snort ET USER_AGENTS Suspicious User-Agent SimpleClient 1.0 rev 3 2012-08-17
snort ET TROJAN Urlzone/Bebloh/Bublik Checkin /was/uid.php rev 1 2012-08-14
snort ET CURRENT_EVENTS DRIVEBY SPL - Landing Page Received rev 2 2012-08-13
snort ET ACTIVEX Possible HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution 2 rev 2 2012-08-10
snort ET CURRENT_EVENTS DRIVEBY SPL - Java Exploit Requested - /spl_data/ rev 1 2012-08-10
snort ET WEB_SPECIFIC_APPS Joomla je-media-player view parameter Local File Inclusion Attempt rev 1 2012-08-10
snort ET WEB_SPECIFIC_APPS dirLIST show_scaled_image.php Local File Inclusion Attempt rev 1 2012-08-10
snort ET WEB_SPECIFIC_APPS dirLIST thumb_gen.php Local File Inclusion Attempt rev 1 2012-08-10
snort ET ACTIVEX Possible HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution rev 2 2012-08-10
snort ET TROJAN FinFisher Malware Connection Handshake rev 2 2012-08-09
snort ET CURRENT_EVENTS Sutra TDS /simmetry rev 1 2012-08-09
snort ET POLICY Suspicious Windows Executable WriteProcessMemory rev 1 2012-08-08
snort ET POLICY Suspicious Windows Executable CreateRemoteThread rev 1 2012-08-08
snort ET ACTIVEX Possible BarCodeWiz BarcodeWiz.dll ActiveX Control Barcode Method Remote Buffer Overflow Attempt rev 2 2012-08-07
snort ET TROJAN W32/Lile.A DoS Outbound rev 4 2012-08-07
snort ET POLICY Executable Download From DropBox rev 4 2012-08-07
snort ET ACTIVEX Possible AOL ICQ ActiveX Control DownloadAgent Method Access Arbitrary File Download and Execute rev 2 2012-08-03
snort ET WEB_SPECIFIC_APPS Joomla Bsadv controller parameter Local File Inclusion Attempt rev 1 2012-08-03
snort ET TROJAN Trojan.Win32.Jorik.Totem.vg HTTP request rev 1 2012-08-03
snort ET ACTIVEX Possible AOL ICQ ActiveX Control DownloadAgent Method Access Arbitrary File Download and Execute 2 rev 2 2012-08-03
snort ET WEB_SPECIFIC_APPS Joomla com_jeformcr view parameter Local File Inclusion Attempt rev 1 2012-08-03
snort ET WEB_SPECIFIC_APPS Joomla com_mailchimpccnewsletter controller parameter Local File Inclusion Attempt rev 1 2012-08-03
snort GPL SCAN ssh-research-scanner rev 6 2012-08-01
snort ET TROJAN Perfect Keylogger Install Email Report rev 8 2012-08-01
snort GPL SCAN nessus 1.X 404 probe rev 10 2012-08-01
snort ET SCAN HTExploit Method rev 1 2012-07-31
snort GPL FTP CWD ... rev 8 2012-07-30
snort GPL SNMP public access tcp rev 14 2012-07-30
snort GPL FTP passwd retrieval attempt rev 6 2012-07-30
snort GPL FTP CWD ~root attempt rev 11 2012-07-30
snort GPL MISC rlogin bin rev 6 2012-07-30
snort GPL FTP invalid MDTM command attempt rev 7 2012-07-30
snort GPL MISC rsh root rev 6 2012-07-30
snort GPL MISC rlogin root rev 6 2012-07-30
snort GPL DNS named authors attempt rev 8 2012-07-30
snort GPL P2P GNUTella client request rev 7 2012-07-30