Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET SHELLCODE Possible %u41%u41%u41%u41 UTF-8 Heap Spray Attempt rev 4 2024-04-09
suricata ET WEB_SPECIFIC_APPS Joomla JGrid Component File Inclusion Attempt rev 5 2024-04-09
suricata ET HUNTING EXE Using Suspicious IAT ZwUnmapViewOfSection Possible Malware Process Hollowing rev 9 2024-04-09
suricata ET WEB_CLIENT Adobe Authplay.dll NewClass Memory Corruption Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS WordPress UnGallery pic Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET ACTIVEX AVTECH Software ActiveX _DownloadPBControl Method Buffer Overflow Attempt rev 5 2024-04-09
suricata ET SHELLCODE Possible Unescape Encoded Content With Split String Obfuscation rev 5 2024-04-09
suricata ET SHELLCODE Double BackSlash Hex Obfuscated JavaScript Heap Spray 41414141 rev 4 2024-04-09
suricata ET MALWARE Shylock Module Server Response rev 4 2024-04-09
suricata ET ACTIVEX Microsoft DirectX 9 msvidctl.dll ActiveX Control Code Execution Attempt rev 9 2024-04-09
suricata ET WEB_SPECIFIC_APPS bug_actiongroup_ext_page.php script Local File Inclusion Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS OrangeHRM path Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET ACTIVEX Gesytec ElonFmt ActiveX Component Format String Function Call rev 4 2024-04-09
suricata ET WEB_SPECIFIC_APPS Joomla Frontend-User-Access controller Parameter Local File Inclusion Attempt rev 6 2024-04-09
suricata ET ACTIVEX Softek Barcode Reader Toolkit ActiveX Control Buffer Overflow Attempt rev 5 2024-04-09
suricata ET SCADA ICONICS WebHMI ActiveX Stack Overflow rev 6 2024-04-09
suricata ET WEB_CLIENT Possible Adobe Acrobat and Reader Pushstring Memory Corruption Attempt rev 4 2024-04-09
suricata ET WEB_SPECIFIC_APPS MaticMarket modulename Parameter Local File Inclusion Attempt-8 rev 7 2024-04-09
suricata ET WEB_CLIENT Adobe Acrobat newfunction Remote Code Execution Attempt rev 6 2024-04-09
suricata ET SCAN Possible Fast-Track Tool Spidering User-Agent Detected rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS ClanSphere CurrentFolder Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS Google Urchin session.cgi Local File Inclusion Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS MaticMarket modulename Parameter Local File Inclusion Attempt-7 rev 6 2024-04-09
suricata ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 5 rev 4 2024-04-09
suricata ET SHELLCODE Double BackSlash Hex Obfuscated JavaScript Heap Spray 0b0b0b0b rev 4 2024-04-09
suricata ET SHELLCODE Possible Encoded %90 NOP SLED rev 6 2024-04-09
suricata ET ACTIVEX Ubisoft CoGSManager ActiveX RunCore method Buffer Overflow Vulnerability rev 4 2024-04-09
suricata ET WEB_SPECIFIC_APPS MantisBT db_type Parameter Local File Inclusion Attempt rev 6 2024-04-09
suricata ET WEB_CLIENT Mozilla Firefox mChannel Object Dangling Pointer Use-After-Free Memory Corruption Attempt rev 3 2024-04-09
suricata ET WEB_SERVER Local Website Infected By Gootkit rev 6 2024-04-09
suricata ET SHELLCODE Hex Obfuscated JavaScript Heap Spray 0d0d0d0d rev 4 2024-04-09
suricata ET ACTIVEX Cisco AnyConnect VPN Secure Mobility Client Cisco.AnyConnect.VPNWeb.1 Arbitrary Program Execution Attempt rev 5 2024-04-09
suricata ET SHELLCODE Unescape Variable Unicode Shellcode rev 3 2024-04-09
suricata ET WEB_CLIENT Adobe Shockwave Director tSAC Chunk memory corruption Attempt rev 8 2024-04-09
suricata ET WEB_SPECIFIC_APPS CultBooking lang parameter Local File Inclusion Attempt rev 6 2024-04-09
suricata ET WEB_CLIENT PDF With Adobe Audition Session File Handling Memory Corruption Attempt rev 4 2024-04-09
suricata ET USER_AGENTS Suspicious User-Agent _updater_agent rev 5 2024-04-09
suricata ET ACTIVEX Magneto ICMP ActiveX ICMPSendEchoRequest Remote Code Execution Attempt rev 3 2024-04-09
suricata ET SCAN Metasploit WMAP GET len 0 and type rev 6 2024-04-09
suricata ET WEB_SPECIFIC_APPS iGaming CMS loadplugin.php load Parameter Local File inclusion Attempt rev 5 2024-04-09