Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET POLICY Splashtop Remote Control Session Start Request rev 1 2012-01-16
snort GPL P2P BitTorrent transfer rev 3 2012-01-16
snort GPL NETBIOS DCERPC Workstation Service direct service access attempt rev 7 2012-01-16
snort GPL FTP CWD Root directory transversal attempt rev 10 2012-01-16
snort GPL NETBIOS SMB startup folder unicode access rev 5 2012-01-16
snort GPL RPC sadmind query with root credentials attempt UDP rev 5 2012-01-16
snort GPL WEB_SERVER globals.pl access rev 5 2012-01-16
snort GPL RPC rexec username too long response rev 6 2012-01-16
snort GPL NETBIOS DCERPC invalid bind attempt rev 5 2012-01-16
snort ET TROJAN Downloader Win32.Small.agoy Checkin rev 6 2012-01-16
snort GPL RPC sadmind query with root credentials attempt TCP rev 5 2012-01-16
snort GPL P2P BitTorrent announce request rev 4 2012-01-16
snort GPL NETBIOS DCERPC Workstation Service direct service bind attempt rev 7 2012-01-16
snort GPL NETBIOS SMB startup folder access rev 6 2012-01-16
snort GPL SMTP AUTH LOGON brute force attempt rev 3 2012-01-16
snort GPL WEB_SERVER Tomcat null byte directory listing attempt rev 6 2012-01-16
snort GPL NETBIOS DCERPC Remote Activation bind attempt rev 16 2012-01-16
snort ET POLICY request to .xxx TLD rev 4 2012-01-16
snort GPL NETBIOS SMB-DS DCERPC Workstation Service unicode bind attempt rev 9 2012-01-16
snort GPL WEB_SERVER mod_gzip_status access rev 3 2012-01-16
snort GPL NETBIOS SMB-DS DCERPC Remote Activation bind attempt rev 15 2012-01-16
snort GPL NETBIOS DCERPC Messenger Service buffer overflow attempt rev 10 2012-01-16
snort ET POLICY Softango.com Installer POSTing Data rev 2 2012-01-13
snort ET POLICY Softango.com Installer Checking For Update rev 1 2012-01-12
snort ET TROJAN Win32.UFRStealer.A issuing MKD command FTP rev 4 2012-01-10
snort ET POLICY Suspicious Invalid HTTP Accept Header of ? rev 2 2012-01-06
snort ET POLICY Outbound MSSQL Connection to Non-Standard Port - Likely Malware rev 3 2012-01-04
snort ET TROJAN Incognito Exploit Kit Checkin rev 4 2012-01-04
snort ET POLICY Dyndns Client IP Check rev 1 2012-01-03
snort ET WEB_SPECIFIC_APPS Mambo Zorder zorder Parameter SELECT FROM SQL Injection Vulnerability rev 4 2012-01-03
snort ET WEB_SPECIFIC_APPS Mambo Zorder zorder Parameter UPDATE SET SQL Injection Vulnerability rev 2 2012-01-03
snort ET WEB_SPECIFIC_APPS SourceBans ajaxargs Parameter Local File Inclusion Attempt rev 2 2012-01-03
snort ET WEB_SPECIFIC_APPS Mambo Zorder zorder Parameter DELETE FROM SQL Injection Vulnerability rev 4 2012-01-03
snort ET POLICY Dyndns Client User-Agent rev 1 2012-01-03
snort ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter DELETE FROM SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter UPDATE SET SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS Joomla com_dshop Component DELETE FROM SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS Joomla com_dshop Component UPDATE SET SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter SELECT FROM SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter UNION SELECT SQL Injection Attempt rev 2 2012-01-02