Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort GPL WEB_SERVER printenv access rev 9 2011-05-02
snort GPL EXPLOIT kadmind buffer overflow attempt rev 9 2011-04-29
snort ET ACTIVEX Gesytec ElonFmt ActiveX Component Format String Function Call rev 2 2011-04-29
snort ET SCAN Possible SQLMAP Scan rev 1 2011-04-29
snort GPL EXPLOIT kadmind buffer overflow attempt rev 9 2011-04-29
snort GPL ATTACK_RESPONSE id check returned apache rev 7 2011-04-29
snort ET WEB_SPECIFIC_APPS OrangeHRM path Parameter Local File Inclusion Attempt rev 2 2011-04-29
snort GPL FTP SITE CPWD overflow attempt rev 9 2011-04-29
snort ET WEB_SPECIFIC_APPS phpRS id parameter UNION SELECT SQL Injection Attempt rev 2 2011-04-29
snort ET WEB_SPECIFIC_APPS phpRS id parameter INSERT INTO SQL Injection Attempt rev 2 2011-04-29
snort GPL EXPLOIT kadmind buffer overflow attempt rev 9 2011-04-29
snort GPL EXPLOIT kadmind buffer overflow attempt rev 9 2011-04-29
snort ET WEB_SPECIFIC_APPS phpRS id parameter SELECT FROM SQL Injection Attempt rev 2 2011-04-29
snort ET WEB_SPECIFIC_APPS phpRS id parameter UPDATE SET SQL Injection Attempt rev 2 2011-04-29
snort GPL ATTACK_RESPONSE id check returned nobody rev 7 2011-04-29
snort GPL SNMP null community string attempt rev 7 2011-04-29
snort ET ACTIVEX Microsoft Internet Explorer Tabular DataURL ActiveX Control Memory Corruption Attempt rev 10 2011-04-29
snort ET WEB_SPECIFIC_APPS phpRS id parameter DELETE FROM SQL Injection Attempt rev 2 2011-04-29
snort ET TROJAN W32 Bamital or Backdoor.Win32.Shiz CnC Communication rev 2 2011-04-28
snort GPL IMAP rename overflow attempt rev 9 2011-04-26
snort GPL RPC CMSD UDP CMSD_CREATE buffer overflow attempt rev 11 2011-04-26
snort GPL IMAP find overflow attempt rev 8 2011-04-26
snort GPL RPC STATD UDP monitor mon_name format string exploit attempt rev 10 2011-04-26
snort GPL RPC STATD UDP stat mon_name format string exploit attempt rev 11 2011-04-26
snort GPL RPC STATD TCP stat mon_name format string exploit attempt rev 11 2011-04-26
snort GPL FTP CWD overflow attempt rev 23 2011-04-26
snort GPL RPC STATD TCP monitor mon_name format string exploit attempt rev 10 2011-04-26
snort GPL RPC CMSD TCP CMSD_INSERT buffer overflow attempt rev 13 2011-04-26
snort ET WEB_SERVER HTTP 414 Request URI Too Large rev 4 2011-04-26
snort ET SCAN OpenVAS User-Agent Inbound rev 4 2011-04-26
snort GPL RPC sadmind TCP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt rev 10 2011-04-26
snort GPL RPC CMSD TCP CMSD_CREATE buffer overflow attempt rev 10 2011-04-26
snort GPL SCAN SolarWinds IP scan attempt rev 7 2011-04-26
snort ET WEB_SPECIFIC_APPS I-Escorts Directory country_id parameter UNION SELECT SQL Injection Attempt rev 2 2011-04-23
snort ET WEB_SPECIFIC_APPS I-Escorts Directory country_id parameter SELECT FROM SQL Injection Attempt rev 2 2011-04-23
snort ET WEB_SPECIFIC_APPS I-Escorts Directory country_id parameter DELETE FROM SQL Injection Attempt rev 2 2011-04-23
snort ET WEB_SPECIFIC_APPS I-Escorts Directory country_id parameter UPDATE SET SQL Injection Attempt rev 2 2011-04-23
snort ET WEB_SPECIFIC_APPS I-Escorts Directory country_id parameter INSERT INTO SQL Injection Attempt rev 2 2011-04-23
snort GPL FTP .forward rev 6 2011-04-22
snort GPL RPC portmap proxy attempt UDP rev 7 2011-04-22