Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN BlackEnergy v2.x HTTP Request with Encrypted Variables rev 7 2012-04-23
snort ET CURRENT_EVENTS TDS Sutra - cookie is set RULEZ rev 1 2012-04-18
snort ET CURRENT_EVENTS TDS Sutra - cookie set RULEZ rev 1 2012-04-18
snort ET TROJAN Mac Flashback Checkin 1 rev 1 2012-04-17
snort ET TROJAN FlashBack Mac OSX malware Checkin rev 4 2012-04-17
snort ET TROJAN Trojan.Win32.Yakes.pwo Checkin rev 2 2012-04-17
snort ET CURRENT_EVENTS Incognito Exploit Kit Java request to images.php?t= rev 1 2012-04-17
snort ET TROJAN W32/UltimateDefender.FakeAV Checkin rev 2 2012-04-16
snort ET ACTIVEX Possible Edraw Diagram Component 5 ActiveX LicenseName Access Potential buffer overflow DOS rev 3 2012-04-16
snort ET TROJAN Likely Infected HTTP POST to PHP with User-Agent of HTTP Client rev 2 2012-04-16
snort ET TROJAN OS X Backdoor Checkin rev 1 2012-04-16
snort ET ACTIVEX Possible Edraw Diagram Component 5 ActiveX LicenseName Access Potential buffer overflow DOS 2 rev 3 2012-04-16
snort ET ACTIVEX Possible IBM Tivoli Provisioning Manager Express Isig.isigCtl.1 ActiveX RunAndUploadFile Method Overflow rev 2 2012-04-13
snort ET ACTIVEX Possible IBM Tivoli Provisioning Manager Express Isig.isigCtl.1 ActiveX RunAndUploadFile Method Overflow 2 rev 2 2012-04-13
snort ET ACTIVEX Possible Dell IT Assistant detectIESettingsForITA.ocx ActiveX Control readRegVal Remote Registry Dump Vulnerability 2 rev 2 2012-04-13
snort ET CURRENT_EVENTS TDS Sutra - cookie set rev 3 2012-04-13
snort ET WEB_SPECIFIC_APPS Joomla com_bulkenquery controller parameter Local File Inclusion Attempt rev 2 2012-04-13
snort ET WEB_SPECIFIC_APPS wordpress thecartpress plugin loop parameter Local File Inclusion Attempt rev 2 2012-04-13
snort ET ACTIVEX Possible Dell IT Assistant detectIESettingsForITA.ocx ActiveX Control readRegVal Remote Registry Dump Vulnerability rev 2 2012-04-13
snort ET WEB_SPECIFIC_APPS Joomla com_br controller parameter Local File Inclusion Attempt rev 2 2012-04-13
snort ET CURRENT_EVENTS TDS Sutra - HTTP header redirecting to a SutraTDS rev 4 2012-04-12
snort ET CURRENT_EVENTS TDS Sutra - request in.cgi rev 1 2012-04-12
snort ET SCAN FHScan core User-Agent Detect rev 4 2012-04-12
snort ET CURRENT_EVENTS TDS Sutra - page redirecting to a SutraTDS rev 1 2012-04-12
snort ET CURRENT_EVENTS TDS Sutra - redirect received rev 2 2012-04-12
snort ET TROJAN Bzub2 Related RPC/Http Checkin rev 4 2012-04-11
snort ET WEB_SPECIFIC_APPS Galerie ShowGallery.php SQL Injection attempt rev 8 2012-04-10
snort ET TROJAN OSX/Flashback.K/I User-Agent rev 3 2012-04-09
snort ET INFO EXE - Served Inline HTTP rev 4 2012-04-06
snort ET TROJAN OSX/Flashback.K first execution checkin rev 2 2012-04-06
snort ET INFO EXE - OSX Executable Download - Multi Arch w/Intel rev 3 2012-04-06
snort ET TROJAN OSX/Flashback.K/I reporting successful infection rev 2 2012-04-06
snort ET TROJAN Win32.Datamaikon Checkin myAgent rev 2 2012-04-06
snort ET CURRENT_EVENTS Exploit Kit Delivering JAR Archive to Client rev 1 2012-04-06
snort ET TROJAN OSX/Flashback.K/I reporting failed infection rev 2 2012-04-06
snort ET TROJAN W32/Taidoor.Backdoor CnC Checkin With Default Substitute MAC Address Field rev 1 2012-04-06
snort ET INFO EXE - OSX Executable Download - Multi Arch w/PowerPC rev 3 2012-04-06
snort ET INFO EXE - OSX Disk Image Download rev 3 2012-04-06
snort ET WEB_CLIENT Internet Explorer CTableRowCellsCollectionCacheItem.GetNext Memory Use-After-Free Attempt rev 2 2012-04-04
snort ET ACTIVEX TRENDnet TV-IP121WN UltraMJCam ActiveX Control OpenFileDlg Access Potential Remote Stack Buffer Overflow 2 rev 5 2012-04-03