Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort GPL NETBIOS SMB CoGetInstanceFromFile little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS nddeapi unicode bind attempt rev 7 2011-09-20
snort GPL NETBIOS SMB llsrpc unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS RemoteActivation unicode attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS RemoteActivation little endian attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS ISystemActivator little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS IrotIsRunning little endian attempt rev 5 2011-09-20
snort GPL NETBIOS SMB NT Trans NT CREATE unicode oversized Security Descriptor attempt rev 5 2011-09-20
snort GPL NETBIOS SMB CoGetInstanceFromFile attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS NDdeSetTrustedShareW unicode overflow attempt rev 7 2011-09-20
snort GPL NETBIOS SMB NT Trans NT CREATE oversized Security Descriptor attempt rev 5 2011-09-20
snort GPL NETBIOS SMB InitiateSystemShutdown unicode attempt rev 6 2011-09-20
snort GPL NETBIOS SMB llsrpc bind attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS C$ unicode share access rev 11 2011-09-20
snort GPL NETBIOS SMB-DS NT Trans NT CREATE unicode oversized Security Descriptor attempt rev 3 2011-09-20
snort GPL NETBIOS SMB OpenKey little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB IActivation bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS llsrpc bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS winreg bind attempt rev 9 2011-09-20
snort GPL NETBIOS SMB CoGetInstanceFromFile unicode overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB RemoteActivation little endian attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS ADMIN$ unicode share access rev 9 2011-09-20
snort GPL NETBIOS SMB CoGetInstanceFromFile unicode little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS CoGetInstanceFromFile little endian attempt rev 4 2011-09-20
snort GPL NETBIOS SMB ISystemActivator bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB irot unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB llsrconnect little endian overflow attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS NDdeSetTrustedShareW overflow attempt rev 6 2011-09-20
snort GPL NETBIOS SMB-DS OpenKey unicode little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB ISystemActivator little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB IrotIsRunning unicode attempt rev 5 2011-09-20
snort GPL NETBIOS SMB winreg little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS llsrpc unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB llsrconnect unicode little endian overflow attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS D$ share access rev 9 2011-09-20
snort GPL NETBIOS SMB llsrconnect unicode overflow attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS CoGetInstanceFromFile little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB InitiateSystemShutdown attempt rev 6 2011-09-20
snort GPL NETBIOS SMB-DS C$ share access rev 12 2011-09-20
snort GPL NETBIOS SMB-DS InitiateSystemShutdown little endian attempt rev 9 2011-09-20