Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET EXPLOIT D-Link DIR-X4860 RCE Attempt Inbound rev 1 2024-05-22
snort ET TROJAN UNK_ConsoleCollie Payload Retrieval Attempt rev 1 2024-05-22
snort ET SCAN OpenVASVT RCE Test String in HTTP Request Inbound rev 3 2024-05-22
snort ET SCAN OpenVASVT RCE Test String in HTTP Request Inbound M3 rev 1 2024-05-22
snort ET EXPLOIT Attempted IDSVSE IP Camera RCE rev 2 2024-05-22
snort ET TROJAN DNS query for Morto RDP worm related domain jifr.net rev 5 2024-05-22
suricata ET MALWARE UNK_ConsoleCollie CnC Checkin rev 1 2024-05-22
suricata ET SCAN OpenVASVT RCE Test String in HTTP Request Outbound rev 3 2024-05-22
suricata ET MALWARE UNK_ConsoleCollie Payload Retrieval Attempt rev 1 2024-05-22
suricata ET SCAN OpenVASVT RCE Test String in HTTP Request Inbound M3 rev 1 2024-05-22
suricata ET EXPLOIT Attempted IDSVSE IP Camera RCE rev 2 2024-05-22
suricata ET MALWARE DNS query for Morto RDP worm related domain jifr.net rev 8 2024-05-22
suricata ET EXPLOIT D-Link DIR-X4860 RCE Attempt Inbound rev 1 2024-05-22
suricata ET MALWARE Observed UNK_ConsoleCollie Malicious SSL Cert rev 1 2024-05-22
suricata ET SCAN OpenVASVT RCE Test String in HTTP Request Inbound rev 3 2024-05-22
suricata ET SCAN OpenVASVT RCE Test String in HTTP Request Inbound M2 rev 1 2024-05-22
snort ET WEB_SERVER SQLi - SELECT and sysobject M2 rev 1 2024-05-21
snort ET WEB_SERVER SQLi - SELECT and sysobject M1 rev 2 2024-05-21
snort ET WEB_SERVER ATTACKER SQLi - SELECT and Schema Columns M2 rev 1 2024-05-21
snort ET WEB_SERVER ATTACKER SQLi - SELECT and Schema Columns M1 rev 2 2024-05-21
snort ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M3 rev 1 2024-05-21
snort ET TROJAN x64/Generic Red Team Activity CnC Response rev 1 2024-05-21
snort ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M2 rev 1 2024-05-21
snort ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M1 rev 3 2024-05-21
snort ET TROJAN AnonymousRAT Payload Retrieval Attempt rev 1 2024-05-21
suricata ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server] rev 6 2024-05-21
suricata ET WEB_SERVER SQLi - SELECT and sysobject M1 rev 3 2024-05-21
suricata ET MALWARE AnonymousRAT Payload Retrieval Attempt rev 1 2024-05-21
suricata ET WEB_SERVER ATTACKER SQLi - SELECT and Schema Columns M2 rev 1 2024-05-21
suricata ET MALWARE x64/Generic Red Team Activity CnC Response rev 1 2024-05-21
suricata GPL WEB_SERVER .htpasswd access rev 10 2024-05-21
suricata ET HUNTING Possible Fake Nintendo User-Agent Observed rev 1 2024-05-21
suricata ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M2 rev 1 2024-05-21
suricata ET PHISHING Chase Phish Landing 2020-10-13 rev 2 2024-05-21
suricata ET WEB_SERVER ATTACKER SQLi - SELECT and Schema Columns M1 rev 3 2024-05-21
suricata GPL CHAT ICQ access rev 16 2024-05-21
suricata ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M3 rev 1 2024-05-21
suricata ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M1 rev 5 2024-05-21
suricata ET WEB_SERVER SQLi - SELECT and sysobject M2 rev 1 2024-05-21
snort ET TROJAN Horabot CnC Host Details Exfil rev 1 2024-05-16