Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET WEB_SERVER WebShell - JSP RAT rev 4 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated Eval String 7 rev 4 2024-03-13
suricata ET ACTIVEX Possible LEADTOOLS ActiveX Raster Twain AppName Method Access Buffer Overflow rev 5 2024-03-13
suricata ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access sendMail rev 4 2024-03-13
suricata ET PHISHING Apple Phishing Landing Jan 30 2014 rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Accessing Importing glassfish rev 3 2024-03-13
suricata ET ACTIVEX Possible Sony PC Companion Admin_RemoveDirectory Stack-based Unicode Buffer Overload SEH rev 4 2024-03-13
suricata ET EXPLOIT_KIT BegOpEK - Landing Page rev 4 2024-03-13
suricata ET ACTIVEX Possible IBM Lotus Quickr for Domino ActiveX control Attachment_Times Method Access buffer overflow Attempt rev 8 2024-03-13
suricata ET EXPLOIT_KIT Fiesta SilverLight Exploit Download rev 3 2024-03-13
suricata ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access sendSMS rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - D.K - Title rev 3 2024-03-13
suricata ET WEB_CLIENT EMET Detection Via XMLDOM rev 5 2024-03-13
suricata ET WEB_CLIENT DRIVEBY Social Engineering Toolkit Web Clone code detected rev 3 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Importing jmx mbeanserver rev 3 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated Eval String 6 rev 4 2024-03-13
suricata ET ACTIVEX Possible Windows Live Writer ActiveX BlogThisLink Method Access Denail of Service Attack rev 6 2024-03-13
suricata ET MALWARE Darkness DDoS HTTP Target/EXE rev 8 2024-03-13
suricata ET WEB_SERVER WebShell - Romanian Webshell rev 5 2024-03-13
suricata ET ACTIVEX Possible Samsung Kies ActiveX PrepareSync method Buffer overflow rev 4 2024-03-13
suricata ET EXPLOIT_KIT Unknown_MM EK - Landing Page rev 3 2024-03-13
suricata ET WEB_SERVER Possible Encrypted Webshell Download rev 5 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class file Accessing Security Manager rev 3 2024-03-13
suricata ET PHISHING Possible iTunes Phishing Landing - Title over non SSL rev 5 2024-03-13
suricata ET ACTIVEX Possible SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX Control Install3rdPartyComponent Method Buffer Overflow rev 5 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated Eval String 4 rev 4 2024-03-13
suricata ET EXPLOIT_KIT Sibhost Zip as Applet Archive July 08 2013 rev 6 2024-03-13
suricata ET MALWARE Gimemo Ransomware Checkin rev 5 2024-03-13
suricata ET MALWARE Drive Receiving POST1 DDoS instructions rev 4 2024-03-13
suricata ET INFO Android Dalvik Executable File Download rev 3 2024-03-13
suricata ET MALWARE WEBC2-TABLE Checkin Response - Embedded CnC APT1 Related rev 3 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated Eval String 3 rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - ASPyder - File Browser - Interface rev 4 2024-03-13
suricata ET MALWARE Drive Receiving IP DDoS instructions rev 4 2024-03-13
suricata ET EXPLOIT_KIT Possible Archie/Metasploit SilverLight Exploit rev 4 2024-03-13
suricata ET WEB_SERVER WebShell Generic eval of gzuncompress rev 9 2024-03-13
suricata ET EXPLOIT_KIT CritXPack - Landing Page - Received rev 3 2024-03-13
suricata ET EXPLOIT Metasploit -Java Atomic Exploit Downloaded rev 3 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Importing management MBeanServer rev 3 2024-03-13
suricata ET WEB_SERVER WebShell - Unknown - self-kill rev 3 2024-03-13