Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata GPL NETBIOS SMB irot bind attempt rev 5 2024-03-14
suricata ET WEB_CLIENT Tech Support Phone Scam Landing 2018-01-10 rev 4 2024-03-14
suricata ET EXPLOIT Possible Firefox PDF.js Same-Origin-Bypass CVE-2015-4495 M2 rev 3 2024-03-14
sigma Remote Access Tool - UltraViewer Execution test 2024-03-14
snort ET TROJAN TA416 Related PUBLOAD Variant Checkin Activity M2 rev 1 2024-03-13
snort ET TROJAN Win32/Spyder CnC Checkin rev 2 2024-03-13
snort ET TROJAN Win32/Spyder Sending Info to CnC rev 2 2024-03-13
snort ET TROJAN DaoDao Cloud Loader C2 Response rev 1 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdOpen Method Access Buffer Overflow 2 rev 5 2024-03-13
suricata ET ACTIVEX Quest Explain Plan Display ActiveX Control SaveToFile Insecure Method Access rev 4 2024-03-13
suricata ET WEB_SERVER WEBSHELL CFM Shell Access rev 3 2024-03-13
suricata ET EXPLOIT_KIT DRIVEBY Java Atomic Exploit Downloaded rev 7 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Mozilla JS Class Creation rev 4 2024-03-13
suricata ET INFO PDF /FlateDecode and PDF version 1.0 rev 4 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdSave Method Access Buffer Overflow rev 5 2024-03-13
suricata ET WEB_CLIENT JS Browser Based Ransomware rev 3 2024-03-13
suricata ET MALWARE W32/Eclipse.DDOSBot CnC Beacon Response rev 4 2024-03-13
suricata ET EXPLOIT_KIT DRIVEBY SPL - Landing Page Received rev 7 2024-03-13
suricata ET EXPLOIT Metasploit mstime_malloc no-spray rev 4 2024-03-13
suricata ET INFO PDF - Acrobat Enumeration - var PDFObject rev 3 2024-03-13
suricata ET ACTIVEX Possible NET-i viewer ActiveX Control ConnectDDNS Method Access Code Execution Vulnerability 2 rev 7 2024-03-13
suricata ET MALWARE Galock Ransomware Command rev 4 2024-03-13
suricata ET ACTIVEX Possible IBM Lotus Quickr for Domino ActiveX control Import_Times Method Access buffer overflow Attempt rev 5 2024-03-13
suricata ET HUNTING Suspicious Possible CollectGarbage in base64 3 rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - JSPCMD - Form rev 3 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class B64 encoded class rev 3 2024-03-13
suricata ET HUNTING SUSPICIOUS .CPL File Inside of Zip rev 4 2024-03-13
suricata ET MALWARE CommentCrew Possible APT backdoor stage 2 download base64 update.gif rev 5 2024-03-13
suricata ET ATTACK_RESPONSE WSO - WebShell Activity - WSO Title rev 4 2024-03-13
suricata ET WEB_SERVER Compromised Wordpress Install Serving Malicious JS rev 7 2024-03-13
suricata ET EXPLOIT_KIT Fiesta Flash Exploit Download rev 3 2024-03-13
suricata ET WEB_SERVER WebShell Generic eval of gzuncompress rev 9 2024-03-13
suricata ET WEB_SERVER ATTACKER WebShell - PHP Offender - Title rev 4 2024-03-13
suricata ET ACTIVEX Possible NVIDIA Install Application ActiveX Control AddPackages Unicode Buffer Overflow rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - PHPShell - Comment rev 3 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Accessing Importing glassfish rev 3 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated Eval String 5 rev 4 2024-03-13
suricata ET ACTIVEX Possible Aloaha PDF Crypter activex SaveToFile method arbitrary file overwrite rev 4 2024-03-13
suricata ET MALWARE Drive Receiving IP DDoS instructions rev 4 2024-03-13
suricata ET MALWARE Possible Backdoor.Adwind Download rev 5 2024-03-13