Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET WEB_SPECIFIC_APPS Simplis CMS download_file Parameter Local File Inclusion Attempt rev 2 2011-09-19
snort ET WEB_SPECIFIC_APPS WordPress Tune Library Plugin letter parameter UNION SELECT SQL Injection Attempt rev 2 2011-09-19
snort ET WEB_SPECIFIC_APPS WordPress Tune Library Plugin letter parameter SELECT FROM SQL Injection Attempt rev 2 2011-09-19
snort GPL ATTACK_RESPONSE id check returned web rev 8 2011-09-16
snort ET TROJAN Downbot/Shady Rat Remote Shell Connection rev 3 2011-09-15
snort ET WEB_SPECIFIC_APPS bug_actiongroup_ext_page.php script Local File Inclusion Attempt rev 2 2011-09-12
snort ET ACTIVEX Tom Sawyer Possible Memory Corruption Attempt Format String Function Call rev 2 2011-09-12
snort ET WEB_SPECIFIC_APPS bug_actiongroup_page.php script Local File Inclusion Attempt rev 2 2011-09-12
snort ET TROJAN FakeAV Landing Page rev 3 2011-09-08
snort ET TROJAN W32/Gagolino Banking Trojan Reporting to CnC rev 1 2011-09-06
snort ET TROJAN BKDR_BTMINE.MNR BitCoin Miner Retrieving Server IP Addresses rev 1 2011-09-06
snort ET TROJAN BKDR_BTMINE.MNR BitCoin Miner Server Checkin rev 1 2011-09-06
snort ET TROJAN W32/iGrabber Info Stealer FTP Upload rev 2 2011-09-06
snort ET TROJAN Driveby Loader Request List.php rev 1 2011-09-02
snort ET POLICY GNU/Linux YUM User-Agent Outbound likely related to package management rev 1 2011-09-02
snort ET POLICY OS X Software Update Request Outbound rev 3 2011-08-31
snort ET TROJAN W32/Lalus Trojan Downloader Checkin rev 1 2011-08-31
snort ET POLICY Netflix Streaming Player Access rev 1 2011-08-30
snort ET TROJAN Zeus Bot GET to Bing checking Internet connectivity rev 1 2011-08-30
snort ET TROJAN Meredrop/Nusump Checkin rev 4 2011-08-29
snort ET POLICY SUSPICIOUS *.doc.exe in HTTP HEADER rev 6 2011-08-29
snort ET POLICY SUSPICIOUS *.pdf.exe in HTTP URL rev 1 2011-08-26
snort ET WEB_SPECIFIC_APPS Joomla Community component userid parameter UPDATE SET SQL Injection Attempt rev 2 2011-08-26
snort ET POLICY SUSPICIOUS *.doc.exe in HTTP URL rev 1 2011-08-26
snort ET WEB_SPECIFIC_APPS Joomla Community component userid parameter INSERT INTO SQL Injection Attempt rev 2 2011-08-26
snort ET SCAN Kingcope KillApache.pl Apache mod_deflate DoS attempt rev 2 2011-08-26
snort ET WEB_SPECIFIC_APPS Joomla Community component userid parameter UNION SELECT SQL Injection Attempt rev 2 2011-08-26
snort ET WEB_SPECIFIC_APPS Joomla Community component userid parameter DELETE FROM SQL Injection Attempt rev 2 2011-08-26
snort ET WEB_SPECIFIC_APPS WordPress UnGallery pic Parameter Local File Inclusion Attempt rev 2 2011-08-26
snort ET TROJAN NgrBot IRC CnC Channel Join rev 1 2011-08-24
snort ET POLICY CNET TechTracker Software Manager request rev 2 2011-08-24
snort ET TROJAN Troxen Downloader Checkin rev 3 2011-08-24
snort ET POLICY BitCoin User-Agent Likely Bitcoin Miner rev 2 2011-08-24
snort ET POLICY CNET Custom Installer Possible Bundled Bloatware rev 2 2011-08-24
snort ET TROJAN W32/NetShare User-Agent rev 2 2011-08-23
snort ET TROJAN Win32/TrojanDownloader.Chekafe.D User-Agent my_check_data On Off HTTP Port rev 1 2011-08-22
snort ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 2 rev 2 2011-08-19
snort ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 3 rev 2 2011-08-19
snort ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 5 rev 2 2011-08-19
snort ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 4 rev 2 2011-08-19