Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp did UNION SELECT rev 7 2010-11-08
snort ET WEB_SPECIFIC_APPS FuseTalk SQL Injection Attempt -- index.cfm SELECT rev 7 2010-11-08
snort ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id SELECT rev 6 2010-11-05
snort ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id DELETE rev 6 2010-11-05
snort ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id UNION SELECT rev 6 2010-11-05
snort ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id UPDATE rev 6 2010-11-05
snort ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id INSERT rev 6 2010-11-05
snort ET SCAN bsqlbf Brute Force SQL Injection rev 6 2010-11-04
snort ET EXPLOIT NTDump.exe Service Started port 139 rev 8 2010-11-04
snort ET EXPLOIT NTDump.exe Service Started port 445 rev 8 2010-11-04
snort ET SCAN WebShag Web Application Scan Detected rev 5 2010-11-04
snort ET EXPLOIT Pwdump4 Session Established GetHash port 445 rev 5 2010-11-04
snort ET WEB_SPECIFIC_APPS Falcon Series One sitemap.xml.php dir Parameter Local File Inclusion rev 4 2010-11-04
snort ET SCAN Watchfire AppScan Web App Vulnerability Scanner rev 6 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access NULL rev 9 2010-11-04
snort ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp SELECT rev 6 2010-11-04
snort ET EXPLOIT Pwdump3e Session Established Reg-Entry port 445 rev 9 2010-11-04
snort ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex UPDATE rev 7 2010-11-04
snort ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid SELECT rev 6 2010-11-04
snort ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid INSERT rev 6 2010-11-04
snort ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid UPDATE rev 6 2010-11-04
snort ET SCAN Tomcat admin-admin login credentials rev 9 2010-11-04
snort ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp UNION SELECT rev 6 2010-11-04
snort ET SCAN Absinthe SQL Injection Tool HTTP Header Detected rev 7 2010-11-04
snort ET WEB_SPECIFIC_APPS F5 Data Manager DiagLogListActionBody.do Local File Inclusion Attempt rev 3 2010-11-04
snort ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex SELECT rev 7 2010-11-04
snort ET SCAN DirBuster Web App Scan in Progress rev 5 2010-11-04
snort ET SCAN Possible Fast-Track Tool Spidering User-Agent Detected rev 5 2010-11-04
snort ET WEB_CLIENT Encoded javascriptdocument.write - usually hostile rev 9 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access COM1 rev 9 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access LPT2 rev 9 2010-11-04
snort ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid DELETE rev 6 2010-11-04
snort ET ATTACK_RESPONSE r57 phpshell footer detected rev 8 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access LPT3 rev 9 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access COM3 rev 9 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access COM2 rev 9 2010-11-04
snort ET EXPLOIT NTDump Session Established Reg-Entry port 139 rev 9 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access COM4 rev 9 2010-11-04
snort ET ATTACK_RESPONSE FTP inaccessible directory access LPT1 rev 9 2010-11-04
snort ET EXPLOIT SQL sp_configure attempt rev 3 2010-11-04