Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort GPL FTP CWD ~<CR><NEWLINE> attempt rev 8 2011-05-25
snort ET SCAN Sqlmap SQL Injection Scan rev 8 2011-05-25
snort GPL EXPLOIT xp_cmdshell program execution 445 rev 6 2011-05-25
snort ET POLICY Hotmail Inbox Access rev 3 2011-05-25
snort GPL RPC portmap rwalld request TCP rev 10 2011-05-25
snort GPL RPC portmap cachefsd request TCP rev 12 2011-05-25
snort GPL FTP CWD .... attempt rev 4 2011-05-25
snort GPL RPC portmap rwalld request UDP rev 10 2011-05-25
snort ET POLICY Cleartext WordPress Login rev 2 2011-05-25
snort GPL RPC portmap cachefsd request UDP rev 12 2011-05-25
snort ET SCAN Rapid IMAP Connections - Possible Brute Force Attack rev 6 2011-05-23
snort ET SCAN Rapid IMAPS Connections - Possible Brute Force Attack rev 9 2011-05-23
snort ET WEB_SPECIFIC_APPS Joomla Component com_hello UNION SELECT SQL Injection Attempt rev 1 2011-05-20
snort ET WEB_SPECIFIC_APPS Joomla Component com_hello DELETE FROM SQL Injection Attempt rev 1 2011-05-20
snort ET WEB_SPECIFIC_APPS Joomla Component com_hello INSERT INTO SQL Injection Attempt rev 1 2011-05-20
snort ET WEB_SPECIFIC_APPS Joomla Component com_hello SELECT FROM SQL Injection Attempt rev 1 2011-05-20
snort ET WEB_SPECIFIC_APPS Joomla Component com_hello UPDATE SET SQL Injection Attempt rev 1 2011-05-20
snort ET WEB_CLIENT PDF With Adobe Audition Session File Handling Memory Corruption Attempt rev 1 2011-05-18
snort GPL WEB_SERVER Oracle Java Process Manager access rev 4 2011-05-18
snort ET WEB_SPECIFIC_APPS Cisco Unified Operations Manager Blind SQL Injection Attempt rev 1 2011-05-18
snort GPL IMAP EXPLOIT partial body overflow attempt rev 10 2011-05-17
snort GPL IMAP authenticate overflow attempt rev 12 2011-05-17
snort GPL IMAP login buffer overflow attempt rev 16 2011-05-17
snort ET WEB_SPECIFIC_APPS WordPress DB XML dump attempted access rev 1 2011-05-15
snort ET WEB_SPECIFIC_APPS Automne upload-controler.php Arbitrary File Upload Vulnerability rev 3 2011-05-14
snort ET SCAN ZmEu exploit scanner rev 7 2011-05-13
snort ET WEB_SPECIFIC_APPS KLINK txtCodiInfo parameter INSERT INTO SQL Injection Attempt rev 2 2011-05-09
snort ET WEB_SPECIFIC_APPS ClanSphere CurrentFolder Parameter Local File Inclusion Attempt rev 2 2011-05-09
snort ET SCADA ICONICS WebHMI ActiveX Stack Overflow rev 2 2011-05-09
snort ET WEB_SPECIFIC_APPS KLINK txtCodiInfo parameter SELECT FROM SQL Injection Attempt rev 2 2011-05-09
snort ET WEB_SPECIFIC_APPS KLINK txtCodiInfo parameter UNION SELECT SQL Injection Attempt rev 2 2011-05-09
snort ET TROJAN Win32/FakeSysdef Rogue AV Checkin rev 7 2011-05-09
snort ET WEB_SPECIFIC_APPS KLINK txtCodiInfo parameter UPDATE SET SQL Injection Attempt rev 2 2011-05-09
snort ET WEB_SPECIFIC_APPS KLINK txtCodiInfo parameter DELETE FROM SQL Injection Attempt rev 3 2011-05-09
snort GPL IMAP fetch overflow attempt rev 3 2011-05-05
snort GPL POLICY Linksys router default password login attempt rev 8 2011-05-02
snort GPL RPC xdmcp info query rev 2 2011-05-02
snort GPL WEB_SERVER printenv access rev 9 2011-05-02
snort GPL POLICY Linksys router default username and password login attempt rev 11 2011-05-02
snort GPL FTP SITE NEWER attempt rev 8 2011-05-02