Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter UPDATE SET SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS WordPress DB XML dump successful leakage rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter UNION SELECT SQL Injection Attempt rev 2 2012-01-02
snort ET WEB_SPECIFIC_APPS jbShop e107 CMS plugin item_id parameter SELECT FROM SQL Injection Attempt rev 2 2012-01-02
snort ET TROJAN Double HTTP/1.1 Header Inbound - Likely Hostile Traffic rev 1 2011-12-30
snort ET TROJAN Gootkit Checkin User-Agent 2 rev 1 2011-12-13
snort ET WEB_SERVER JBoss jmx-console Probe rev 1 2011-12-10
snort ET TROJAN Smokeloader getgrab Command rev 1 2011-12-09
snort ET TROJAN Smokeloader getload Command rev 1 2011-12-09
snort ET TROJAN Smokeloader getsock Command rev 1 2011-12-09
snort ET TROJAN Backdoor.Win32.Sykipot Put rev 1 2011-12-09
snort ET TROJAN Smokeloader getproxy Command rev 1 2011-12-09
snort ET SCAN SQLix SQL Injection Vector Scan rev 7 2011-12-08
snort ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby rev 2 2011-12-07
snort ET WEB_SPECIFIC_APPS Zabbix popup.php UPDATE SET SQL Injection Vulnerability rev 2 2011-12-02
snort ET WEB_SPECIFIC_APPS Zabbix popup.php INSERT INTO SQL Injection Vulnerability rev 2 2011-12-02
snort ET WEB_SPECIFIC_APPS Zabbix popup.php UNION SELECT SQL Injection Vulnerability rev 2 2011-12-02
snort GPL FTP pass wh00t rev 7 2011-12-02
snort GPL FTP piss scan rev 7 2011-12-02
snort ET WEB_SPECIFIC_APPS Zabbix popup.php DELETE FROM SQL Injection Vulnerability rev 2 2011-12-02
snort ET WEB_SPECIFIC_APPS Web File Browser file Parameter Local File Inclusion Attempt rev 2 2011-12-02
snort GPL FTP saint scan rev 7 2011-12-02
snort GPL FTP iss scan rev 7 2011-12-02
snort GPL FTP SITE EXEC attempt rev 16 2011-12-02
snort GPL FTP satan scan rev 7 2011-12-02
snort ET WEB_SPECIFIC_APPS Joomla component img Local File Inclusion Attempt rev 2 2011-12-02
snort GPL FTP tar parameters rev 14 2011-12-02
snort ET WEB_SPECIFIC_APPS Zabbix popup.php SELECT FROM SQL Injection Vulnerability rev 2 2011-12-02
snort GPL SCAN adm scan rev 7 2011-12-01
snort GPL FTP MKD overflow rev 12 2011-12-01
snort GPL SQL sa brute force failed login attempt rev 4 2011-12-01
snort GPL NETBIOS SMB-DS NT Trans NT CREATE unicode invalid SACL ace size dos attempt rev 5 2011-12-01
snort GPL NETBIOS SMB-DS NT Trans NT CREATE unicode invalid SACL ace size dos attempt rev 5 2011-12-01
snort GPL NETBIOS DCERPC IrotIsRunning little endian attempt rev 4 2011-11-30
snort GPL NETBIOS DCERPC CoGetInstanceFromFile overflow attempt rev 4 2011-11-30
snort GPL NETBIOS DCERPC IActivation bind attempt rev 3 2011-11-30
snort GPL NETBIOS DCERPC IrotIsRunning attempt rev 4 2011-11-30
snort GPL NETBIOS SMB NT Trans NT CREATE unicode invalid SACL ace size dos attempt rev 6 2011-11-30
snort GPL NETBIOS DCERPC msqueue bind attempt rev 4 2011-11-30
snort GPL NETBIOS SMB-DS NT Trans NT CREATE SACL overflow attempt rev 5 2011-11-30