Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET ACTIVEX Ask.com Toolbar askBar.dll ActiveX ShortFormat Buffer Overflow Attempt rev 5 2012-04-03
snort ET POLICY PPTP Requester is not authorized to establish a command channel rev 4 2012-04-02
snort ET ACTIVEX TRENDnet TV-IP121WN UltraMJCam ActiveX Control OpenFileDlg Access Potential Remote Stack Buffer Overflow rev 4 2012-04-01
snort ET ACTIVEX Dell Webcam CrazyTalk ActiveX Control BackImage Access Potential Buffer Overflow Attempt rev 2 2012-04-01
snort GPL WEB_SERVER DELETE attempt rev 14 2012-03-28
snort ET WEB_SPECIFIC_APPS Joomla Community component userid parameter SELECT FROM SQL Injection Attempt rev 3 2012-03-27
snort ET TROJAN Yayih.A Checkin rev 2 2012-03-27
snort ET TROJAN Backdoor.Win32.RShot HTTP Checkin rev 2 2012-03-27
snort ET TROJAN W32/GamesForum.InfoStealer Reporting to CnC rev 2 2012-03-27
snort ET TROJAN UPDATE Protocol Trojan Communication detected on non-http ports 2 rev 5 2012-03-27
snort ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ImportSettings Function Call Attempt rev 3 2012-03-26
snort ET WEB_SPECIFIC_APPS OneFileCMS f parameter Local File Inclusion Attempt rev 2 2012-03-26
snort ET TROJAN SpyEye Checkin version 1.3.25 or later rev 4 2012-03-26
snort ET WEB_SPECIFIC_APPS VTiger CRM module_name parameter Local File Inclusion Attempt rev 2 2012-03-26
snort ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ExportSettings Remote File Overwrite Attempt rev 2 2012-03-26
snort ET ACTIVEX 2X Client for RDP ClientSystem Class ActiveX Control InstallClient Function Call Attempt rev 2 2012-03-26
snort ET TROJAN TROJAN Win32-WebSec Reporting rev 4 2012-03-26
snort ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ImportSettings Remote File Overwrite Attempt rev 4 2012-03-26
snort ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ExportSettings Function Call Attempt rev 2 2012-03-26
snort ET TROJAN W32/Jiwerks.A Checkin rev 4 2012-03-26
snort ET TROJAN MSUpdater POST checkin to CnC rev 2 2012-03-26
snort ET TROJAN Trojan Downloader.Bancos Reporting rev 3 2012-03-26
snort ET TROJAN Backdoor.Win32.Ixeshe rev 4 2012-03-23
snort ET TROJAN Backdoor.Win32.Sykipot Get Config Request rev 4 2012-03-23
snort ET TROJAN Jorik FakeAV GET rev 4 2012-03-22
snort ET TROJAN Cycbot POST rev 2 2012-03-22
snort ET TROJAN Win32.PEx.Delphi.1151005043 Post-infection Checkin rev 2 2012-03-22
snort ET TROJAN Win32.Shiz.fxm/Agent-TBT Checkin rev 5 2012-03-21
snort ET TROJAN Backdoor.Win32/Momibot Ping Checkin rev 2 2012-03-21
snort ET TROJAN W32/Mnless Checkin rev 3 2012-03-21
snort ET TROJAN Backdoor.Win32/Momibot Checkin rev 4 2012-03-21
snort ET TROJAN Possible Ponmocup Driveby Download rev 2 2012-03-21
snort ET TROJAN W32.Qakbot Webpage Infection Routine POST rev 2 2012-03-20
snort ET TROJAN Zeus Bot GET to Google checking Internet connectivity rev 6 2012-03-20
snort ET TROJAN Win32.Meredrop Checkin rev 3 2012-03-20
snort ET WEB_SPECIFIC_APPS RJ-iTop Network Vulnerabilities Scan System id UPDATE SET SQL Injection Attempt rev 4 2012-03-20
snort ET TROJAN Trojan Internet Connectivity Check rev 4 2012-03-20
snort ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php pid INSERT rev 6 2012-03-20
snort ET TROJAN Papras Banking Trojan Checkin rev 4 2012-03-20
snort ET WEB_SPECIFIC_APPS RJ-iTop Network Vulnerabilities Scan System id INSERT INTO SQL Injection Attempt rev 4 2012-03-20