Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET ACTIVEX Possible Chilkat Software FTP2 ActiveX Component GetFile Access Remote Code Execution rev 6 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdImport Method Access Buffer Overflow rev 5 2024-03-13
suricata ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access sendSMS rev 4 2024-03-13
suricata ET INFO Embedded Executable File in PDF - This Program Cannot Be Run in DOS Mode rev 8 2024-03-13
suricata ET SHELLCODE Possible UTF-16 u9090 NOP SLED rev 5 2024-03-13
suricata ET ACTIVEX Possible SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX Control Install3rdPartyComponent Method Buffer Overflow rev 5 2024-03-13
suricata ET EXPLOIT_KIT CritXPack Landing Page rev 3 2024-03-13
suricata ET ACTIVEX Possible SkinCrafter ActiveX Control InitLicenKeys Method Access Buffer Overflow rev 6 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Mozilla JS Class Creation rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Importing glassfish external statistics impl rev 3 2024-03-13
suricata ET ACTIVEX Possible IBM Lotus Quickr for Domino ActiveX control Import_Times Method Access buffer overflow Attempt rev 5 2024-03-13
suricata ET WEB_SERVER Possible Encrypted Webshell Download rev 5 2024-03-13
suricata ET MALWARE Embedded Android Dalvik Executable File With Fake Windows Executable Header - Possible AV Bypass Attempt rev 4 2024-03-13
suricata ET MALWARE Tinba Server Response rev 5 2024-03-13
suricata ET EXPLOIT_KIT Unknown_MM - Payload Download rev 3 2024-03-13
suricata ET MALWARE CommentCrew Possible APT c2 communications sleep5 rev 5 2024-03-13
suricata ET INFO Microsoft Script Encoder Encoded File rev 5 2024-03-13
suricata ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access takeCameraPicture rev 4 2024-03-13
suricata ET MALWARE Win32/Spyder Sending Info to CnC rev 2 2024-03-13
suricata ET HUNTING SUSPICIOUS .PIF File Inside of Zip rev 6 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdOpen Method Access Buffer Overflow 2 rev 5 2024-03-13
suricata ET MALWARE Hoic.zip retrieval rev 4 2024-03-13
suricata ET WEB_SERVER Compromised Wordpress Install Serving Malicious JS rev 7 2024-03-13
suricata ET ACTIVEX Possible Samsung Kies ActiveX PrepareSync method Buffer overflow rev 4 2024-03-13
suricata ET MALWARE W32/Eclipse.DDOSBot CnC Beacon Response rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - Generic - c99shell based header w/colons rev 4 2024-03-13
suricata ET EXPLOIT_KIT Possible WhiteLotus EK 2013-2551 Exploit 3 rev 5 2024-03-13
suricata ET MALWARE CommentCrew Possible APT crabdance backdoor base64 head rev 5 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Accessing Importing glassfish rev 3 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated Eval String 1 rev 4 2024-03-13
suricata ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access sendMail rev 4 2024-03-13
suricata ET MALWARE APT_NGO_wuaclt PDF file rev 3 2024-03-13
suricata ET ACTIVEX Possible LEADTOOLS ActiveX Raster Twain AppName Method Access Buffer Overflow rev 5 2024-03-13
suricata ET ACTIVEX Possible IBM Lotus Quickr for Domino ActiveX control Attachment_Times Method Access buffer overflow Attempt rev 8 2024-03-13
suricata ET MALWARE CommentCrew Possible APT c2 communications sleep rev 4 2024-03-13
suricata ET WEB_CLIENT Malicious iframe guessing router password 1 rev 5 2024-03-13
suricata ET ACTIVEX Possible Advantech Studio ISSymbol ActiveX Control Multiple Buffer Overflow Attempt rev 4 2024-03-13
suricata ET PHISHING Apple Phishing Landing Jan 30 2014 rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - MySQL Interface - Database List rev 3 2024-03-13
suricata ET EXPLOIT_KIT Fiesta SilverLight Exploit Download rev 3 2024-03-13