Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET WEB_SPECIFIC_APPS Horde type Parameter Local File Inclusion Attempt rev 6 2024-04-09
suricata ET SHELLCODE Double BackSlash Hex Obfuscated JavaScript NOP SLED rev 4 2024-04-09
suricata ET SHELLCODE Hex Obfuscated JavaScript Heap Spray 0c0c0c0c rev 4 2024-04-09
suricata ET WEB_SPECIFIC_APPS Joomla Jimtawl Component task Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET ACTIVEX AVTECH Software ActiveX _DownloadPBClose Method Buffer Overflow Attempt rev 5 2024-04-09
suricata ET ACTIVEX AVTECH Software ActiveX _DownloadPBOpen Method Buffer Overflow Attempt rev 5 2024-04-09
suricata ET WEB_CLIENT Likely Malicious PDF Containing StrReverse rev 5 2024-04-09
suricata ET ACTIVEX Cisco AnyConnect VPN Secure Mobility Client Cisco.AnyConnect.VPNWeb.1 Arbitrary Program Execution Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS iGaming CMS loadplugin.php load Parameter Local File inclusion Attempt rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS Open Web Analytics owa_do Parameter Local File inclusion Attempt rev 6 2024-04-09
suricata ET SCAN Havij SQL Injection Tool User-Agent Outbound rev 4 2024-04-09
suricata ET SHELLCODE Possible UTF-16 %u9090 NOP SLED rev 6 2024-04-09
suricata ET ACTIVEX Microsoft DirectX 9 ActiveX Control Format String Function Call rev 6 2024-04-09
suricata ET MALWARE Winsoft.E Checkin 3 rev 4 2024-04-09
suricata ET WEB_SPECIFIC_APPS N-13 News default_login_language Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET USER_AGENTS Suspicious User-Agent _updater_agent rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS ClanSphere CurrentFolder Parameter Local File Inclusion Attempt rev 5 2024-04-09
suricata ET EXPLOIT Linksys WAP54G debug.cgi Shell Access as Gemtek rev 7 2024-04-09
suricata ET WEB_CLIENT DLL or EXE File From Possible WebDAV Share Possible DLL Preloading Exploit Attempt rev 11 2024-04-09
suricata ET WEB_CLIENT Hex Obfuscation of Script Tag %u UTF-8 Encoding rev 5 2024-04-09
suricata ET WEB_SPECIFIC_APPS Tiki Wiki CMS Groupware language Parameter Local File Inclusion Attempt rev 7 2024-04-09
suricata ET WEB_CLIENT Hex Obfuscation of replace Javascript Function %u UTF-8 Encoding rev 6 2024-04-09
suricata ET SHELLCODE Possible %41%41%41%41 Heap Spray Attempt rev 4 2024-04-09
suricata ET WEB_SPECIFIC_APPS LetoDMS lang Parameter Local File Inclusion Attempt rev 6 2024-04-09
suricata ET WEB_CLIENT PDF Containing Windows Commands Downloaded rev 5 2024-04-09
snort ET TROJAN W32/Zbot.Variant CnC Response rev 4 2024-04-08
snort ET CURRENT_EVENTS Redkit Exploit Kit Three Numerical Character Naming Convention PDF Request rev 2 2024-04-08
snort ET TROJAN Zberp receiving config via image file - SET rev 9 2024-04-08
snort ET CURRENT_EVENTS Possible Pony DLL Download rev 3 2024-04-08
snort ET TROJAN Possible Dridex Download URI Struct with no referer rev 6 2024-04-08
snort ET TROJAN Mal/Ransom-CE Connectivity Check rev 4 2024-04-08
snort ET EXPLOIT Possible Misfortune Cookie - SET rev 2 2024-04-08
snort ET INFO Packed Executable Download rev 3 2024-04-08
snort ET INFO Anonymous File Sharing Service Domain in DNS Lookup rev 1 2024-04-08
snort ET TROJAN Possible Kelihos.F EXE Download Common Structure 2 rev 4 2024-04-08
snort ET TROJAN Sage Ransomware Checkin Primer rev 3 2024-04-08
snort ET DOS HOIC with booster outbound rev 3 2024-04-08
snort ET INFO EXE Download With Content Type Specified As Empty rev 4 2024-04-08
snort ET TROJAN Bebloh connectivity check rev 4 2024-04-08
snort ET CURRENT_EVENTS FlimKit hex.zip Java Downloading Jar rev 4 2024-04-08