Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort GPL NETBIOS SMB-DS InitiateSystemShutdown attempt rev 10 2011-09-20
snort GPL NETBIOS SMB msqueue unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB InitiateSystemShutdown little endian attempt rev 6 2011-09-20
snort GPL NETBIOS SMB-DS nddeapi unicode bind attempt rev 7 2011-09-20
snort GPL NETBIOS SMB llsrpc unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS OpenKey little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB NDdeSetTrustedShareW unicode overflow attempt rev 6 2011-09-20
snort GPL NETBIOS SMB OpenKey overflow attempt rev 5 2011-09-20
snort GPL NETBIOS SMB NDdeSetTrustedShareW unicode little endian overflow attempt rev 6 2011-09-20
snort GPL NETBIOS SMB-DS IrotIsRunning unicode little endian attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS irot little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS IrotIsRunning attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS msqueue unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS RemoteActivation attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS nddeapi unicode create tree attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS OpenKey unicode overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB IActivation bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS NT Trans NT CREATE unicode oversized Security Descriptor attempt rev 3 2011-09-20
snort GPL NETBIOS SMB llsrpc bind attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS NDdeSetTrustedShareW unicode overflow attempt rev 7 2011-09-20
snort GPL NETBIOS SMB-DS NDdeSetTrustedShareW overflow attempt rev 6 2011-09-20
snort GPL NETBIOS SMB-DS C$ unicode share access rev 11 2011-09-20
snort GPL NETBIOS SMB irot unicode bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB ISystemActivator bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB IrotIsRunning unicode attempt rev 5 2011-09-20
snort GPL NETBIOS SMB llsrconnect unicode little endian overflow attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS OpenKey unicode little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS D$ share access rev 9 2011-09-20
snort GPL NETBIOS SMB winreg little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS CoGetInstanceFromFile little endian attempt rev 4 2011-09-20
snort GPL NETBIOS SMB irot little endian bind attempt rev 4 2011-09-20
snort GPL NETBIOS SMB-DS RemoteActivation unicode little endian attempt rev 4 2011-09-20
snort GPL NETBIOS SMB OpenKey unicode overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB NT Trans NT CREATE oversized Security Descriptor attempt rev 5 2011-09-20
snort GPL NETBIOS SMB OpenKey little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB CoGetInstanceFromFile unicode little endian overflow attempt rev 4 2011-09-20
snort GPL NETBIOS SMB nddeapi unicode create tree attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS winreg bind attempt rev 9 2011-09-20
snort GPL NETBIOS SMB NT Trans NT CREATE unicode oversized Security Descriptor attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS ADMIN$ unicode share access rev 9 2011-09-20