Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort GPL NETBIOS DCERPC IrotIsRunning little endian attempt rev 4 2011-11-30
snort GPL NETBIOS DCERPC irot little endian bind attempt rev 3 2011-11-30
snort GPL NETBIOS SMB-DS NT Trans NT CREATE SACL overflow attempt rev 5 2011-11-30
snort GPL NETBIOS DCERPC IActivation little endian bind attempt rev 3 2011-11-30
snort GPL NETBIOS DCERPC IActivation bind attempt rev 3 2011-11-30
snort GPL NETBIOS DCERPC IrotIsRunning attempt rev 4 2011-11-30
snort GPL NETBIOS SMB-DS NT Trans NT CREATE unicode DACL overflow attempt rev 5 2011-11-30
snort GPL NETBIOS SMB-DS NT Trans NT CREATE DACL overflow attempt rev 5 2011-11-30
snort GPL NETBIOS DCERPC irot bind attempt rev 3 2011-11-30
snort GPL NETBIOS SMB-DS NT Trans NT CREATE invalid SACL ace size dos attempt rev 5 2011-11-30
snort GPL NETBIOS SMB NT Trans NT CREATE DACL overflow attempt rev 5 2011-11-30
snort GPL NETBIOS SMB-DS NT Trans NT CREATE unicode SACL overflow attempt rev 5 2011-11-30
snort GPL NETBIOS SMB NT Trans NT CREATE invalid SACL ace size dos attempt rev 5 2011-11-30
snort GPL NETBIOS DCERPC msqueue bind attempt rev 4 2011-11-30
snort GPL NETBIOS SMB NT Trans NT CREATE unicode DACL overflow attempt rev 5 2011-11-30
snort GPL NETBIOS SMB-DS NT Trans NT CREATE invalid SACL ace size dos attempt rev 5 2011-11-30
snort GPL NETBIOS SMB NT Trans NT CREATE unicode SACL overflow attempt rev 5 2011-11-30
snort ET MOBILE_MALWARE Android/Ozotshielder.A Checkin rev 1 2011-11-24
snort ET MOBILE_MALWARE Android/KungFu Package Delete Command rev 1 2011-11-24
snort ET MOBILE_MALWARE Android/SndApp.B Sending Device Information rev 1 2011-11-24
snort ET POLICY Windows Mobile 7.0 User-Agent detected rev 2 2011-11-21
snort ET POLICY external cPanel login rev 1 2011-11-18
snort ET WEB_SERVER DNS changer cPanel attempt rev 1 2011-11-18
snort ET POLICY external cPanel password change rev 1 2011-11-18
snort ET TROJAN General Win32 Backdoor Checkin POST Packet 1 rev 8 2011-11-17
snort ET TROJAN Win32/Dofoil.L Checkin rev 3 2011-11-16
snort ET TROJAN Spy-Net Trojan Connection rev 4 2011-11-16
snort ET GAMES Second Life setup download rev 2 2011-11-11
snort ET TROJAN Backdoor.Win32.Svlk Client Checkin rev 1 2011-11-09
snort ET WEB_SPECIFIC_APPS Joomla techfolio component UPDATE SET SQL Injection Attempt rev 2 2011-11-08
snort ET WEB_SPECIFIC_APPS 1024 CMS filename Parameter Local File Inclusion Attempt rev 2 2011-11-08
snort ET WEB_SPECIFIC_APPS Joomla techfolio component SELECT FROM SQL Injection Attempt rev 2 2011-11-08
snort ET TROJAN GET to Google with specific HTTP lib likely Cycbot/Bifrose/Kryptic checking Internet connection rev 4 2011-11-08
snort ET POLICY Bomgar Remote Assistance Tool Download rev 1 2011-11-08
snort ET WEB_SPECIFIC_APPS WHMCompleteSolution templatefile Parameter Local File Inclusion Attempt rev 2 2011-10-31
snort ET TROJAN Bot Backdoor Checkin/registration Request rev 6 2011-10-31
snort ET WEB_SPECIFIC_APPS SnippetMaster vars.inc.php _SESSION Parameter Local File Inclusion rev 4 2011-10-31
snort ET WEB_SPECIFIC_APPS Possible Rentventory SQL Injection Attempt rev 7 2011-10-31
snort ET WEB_SPECIFIC_APPS Joomla YJ Contact Local File Inclusion Vulnerability rev 2 2011-10-31
snort GPL EXPLOIT Alternate Data streams ASP file access attempt rev 14 2011-10-24