Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort GPL FTP RMD overflow attempt rev 10 2011-04-21
snort GPL FTP REST overflow attempt rev 7 2011-04-21
snort GPL WORM Slammer Worm propagation attempt OUTBOUND rev 8 2011-04-21
snort GPL CHAT MSN user search rev 2 2011-04-21
snort GPL RPC portmap espd request UDP rev 13 2011-04-21
snort GPL RPC portmap kcms_server request TCP rev 11 2011-04-21
snort GPL MISC CVS invalid repository response rev 3 2011-04-21
snort ET WEB_SPECIFIC_APPS Joomla virtuemart Blind SQL Injection Attempt rev 3 2011-04-21
snort GPL FTP DELE overflow attempt rev 9 2011-04-21
snort GPL RPC yppasswd username overflow attempt UDP rev 10 2011-04-21
snort ET WEB_SPECIFIC_APPS eGroupware loaddetails.php script UNION SELECT SQL Injection Attempt rev 2 2011-04-21
snort GPL RPC portmap status request TCP rev 7 2011-04-21
snort GPL MISC CVS double free exploit attempt response rev 5 2011-04-21
snort GPL MISC CVS invalid user authentication response rev 5 2011-04-21
snort ET WEB_SPECIFIC_APPS eGroupware loaddetails.php script UPDATE SET SQL Injection Attempt rev 2 2011-04-21
snort GPL FTP MKD overflow attempt rev 10 2011-04-21
snort ET ATTACK_RESPONSE Possible MS CMD Shell opened on local system rev 9 2011-04-15
snort ET WEB_SPECIFIC_APPS vBulletin cChatBox messageid Parameter SELECT FROM SQL Injection Attempt rev 2 2011-04-11
snort ET WEB_SPECIFIC_APPS PHP-Nuke Surveys pollID parameter DELETE FROM SQL Injection Attempt rev 2 2011-04-11
snort ET WEB_SPECIFIC_APPS vBulletin cChatBox messageid Parameter INSERT INTO SQL Injection Attempt rev 2 2011-04-11
snort ET POLICY Windows-Based OpenSSL Tunnel Connection Outbound 2 rev 4 2011-04-11
snort ET WEB_SPECIFIC_APPS PHP-Nuke Surveys pollID parameter UPDATE SET SQL Injection Attempt rev 2 2011-04-11
snort ET POLICY Windows-Based OpenSSL Tunnel Connection Outbound 3 rev 4 2011-04-11
snort ET WEB_SPECIFIC_APPS Andy PHP Knowledgebase SQL Injection Attempt pdfgen.php pdfa INSERT rev 2 2011-04-11
snort ET POLICY Windows-Based OpenSSL Tunnel Outbound rev 5 2011-04-11
snort ET WEB_SPECIFIC_APPS PHP-Nuke Surveys pollID parameter INSERT INTO SQL Injection Attempt rev 2 2011-04-11
snort ET WEB_SPECIFIC_APPS Andy PHP Knowledgebase SQL Injection Attempt pdfgen.php pdfa DELETE rev 2 2011-04-11
snort ET WEB_SPECIFIC_APPS Andy PHP Knowledgebase SQL Injection Attempt pdfgen.php pdfa UPDATE rev 2 2011-04-11
snort ET WEB_SPECIFIC_APPS Andy PHP Knowledgebase SQL Injection Attempt pdfgen.php pdfa SELECT rev 3 2011-04-11
snort ET WEB_SPECIFIC_APPS eyeOS file Parameter Local File Inclusion Attempt rev 2 2011-04-11
snort ET WEB_SPECIFIC_APPS vBulletin cChatBox messageid Parameter DELETE FROM SQL Injection Attempt rev 2 2011-04-11
snort ET WEB_SPECIFIC_APPS vBulletin cChatBox messageid Parameter UPDATE SET SQL Injection Attempt rev 2 2011-04-11
snort ET WEB_SPECIFIC_APPS Andy PHP Knowledgebase SQL Injection Attempt pdfgen.php pdfa UNION SELECT rev 2 2011-04-11
snort ET WEB_SPECIFIC_APPS vBulletin cChatBox messageid Parameter UNION SELECT SQL Injection Attempt rev 2 2011-04-11
snort ET WEB_SPECIFIC_APPS LoCal Calendar System LIBDIR Parameter Local File Inclusion Attempt rev 2 2011-04-11
snort ET WEB_SPECIFIC_APPS PHP-Nuke Surveys pollID parameter UNION SELECT SQL Injection Attempt rev 2 2011-04-11
snort ET WEB_SPECIFIC_APPS PHP-Nuke Surveys pollID parameter SELECT FROM SQL Injection Attempt rev 2 2011-04-11
snort ET POLICY Dropbox Client Broadcasting rev 3 2011-04-09
snort ET USER_AGENTS Suspicious User-Agent Sample rev 3 2011-04-01
snort ET SCAN Havij SQL Injection Tool User-Agent Inbound rev 2 2011-03-31