Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort GPL EXPLOIT xp_cmdshell - program execution rev 6 2012-07-27
snort GPL SMTP expn decode rev 10 2012-07-27
snort GPL EXPLOIT /iisadmpwd/aexp2.htr access rev 12 2012-07-27
snort GPL EXPLOIT iisadmpwd attempt rev 12 2012-07-27
snort ET ACTIVEX Possible Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute rev 2 2012-07-27
snort GPL EXPLOIT xp_sprintf possible buffer overflow rev 10 2012-07-27
snort GPL EXPLOIT rsh froot rev 7 2012-07-27
snort GPL EXPLOIT xp_filelist attempt rev 7 2012-07-27
snort GPL EXPLOIT /msadc/samples/ access rev 10 2012-07-27
snort GPL EXPLOIT NTLM ASN.1 vulnerability scan attempt rev 11 2012-07-27
snort GPL SNMP public access udp rev 12 2012-07-27
snort GPL EXPLOIT .htr access rev 16 2012-07-27
snort GPL SMTP expn root rev 13 2012-07-27
snort GPL SMTP vrfy decode rev 10 2012-07-27
snort ET TROJAN FakeAvCn-A Checkin 3 rev 3 2012-07-26
snort ET TROJAN ProxyBox - HTTP CnC - POST 1-letter.php rev 5 2012-07-24
snort ET WEB_SPECIFIC_APPS SaschArt SasCam Webcam Server ActiveX Buffer Overflow Function Call rev 3 2012-07-23
snort ET WEB_SPECIFIC_APPS ClickTech ClickContact SQL Injection Attempt -- default.asp AlphaSort UNION SELECT rev 6 2012-07-23
snort ET WEB_SERVER SQL Injection BULK INSERT in URI to Insert File Content into Database Table rev 4 2012-07-23
snort ET ACTIVEX Possible Oracle AutoVue ActiveX SetMarkupMode Method Access Remote Code Execution rev 3 2012-07-23
snort ET TROJAN ProxyBox - HTTP CnC - get_servers.php rev 2 2012-07-21
snort ET TROJAN ProxyBox - HTTP CnC - getiplist.php rev 2 2012-07-21
snort ET TROJAN ProxyBox - HTTP CnC - .com.tw/check_version.php rev 1 2012-07-21
snort ET TROJAN ProxyBox - ProxyBotCommand - I_AM rev 2 2012-07-21
snort ET TROJAN ProxyBox - HTTP CnC - botinfo.php rev 2 2012-07-21
snort ET ACTIVEX Possible CA BrightStor ARCserve Backup ActiveX AddColumn Method Access Buffer Overflow rev 2 2012-07-20
snort ET WEB_SPECIFIC_APPS Wordpress Plugin Newsletter data parameter Local File Inclusion vulnerability rev 1 2012-07-20
snort ET WEB_SPECIFIC_APPS Joomla com_hello controller parameter Local File Inclusion vulnerability rev 1 2012-07-20
snort ET ACTIVEX Possible CommuniCrypt Mail SMTP ActiveX AddAttachments Method Access Stack Buffer Overflow rev 2 2012-07-20
snort ET WEB_SPECIFIC_APPS Wordpress Plugin PICA Photo Gallery imgname parameter Local File Inclusion Attempt rev 1 2012-07-20
snort ET ACTIVEX Possible CA BrightStor ARCserve Backup ActiveX AddColumn Method Access Buffer Overflow 2 rev 3 2012-07-20
snort ET WEB_SPECIFIC_APPS Web Edition mod parameter Local File Inclusion vulnerability rev 1 2012-07-20
snort ET INFO Java .jar request to dotted-quad domain rev 2 2012-07-18
snort ET SCAN w3af User-Agent 2 rev 1 2012-07-18
snort ET POLICY TuneIn Internet Radio Usage Detected rev 1 2012-07-18
snort ET WEB_SERVER Compromised Wordpress Install Serving Malicious JS rev 2 2012-07-17
snort ET TROJAN Pony Downloader check-in response STATUS-IMPORT-OK rev 5 2012-07-15
snort ET TROJAN ZeroAccess udp traffic detected rev 2 2012-07-14
snort ET WEB_SPECIFIC_APPS joomla com_jstore controller parameter Local File Inclusion vulnerability rev 1 2012-07-13
snort ET WEB_SPECIFIC_APPS joomla com_edir controller parameter Local File Inclusion vulnerability rev 1 2012-07-13