Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class B64 encoded class rev 3 2024-03-13
suricata ET EXPLOIT Possible 2012-1533 altjvm RCE via JNLP command injection rev 4 2024-03-13
suricata ET HUNTING Suspicious Possible CollectGarbage in base64 1 rev 4 2024-03-13
suricata ET WEB_CLIENT Possible FortDisco Wordpress Brute-force Site list download 10+ wp-login.php rev 4 2024-03-13
suricata ET WEB_SERVER WebShell Generic eval of str_rot13 rev 9 2024-03-13
suricata ET EXPLOIT Metasploit mstime_malloc no-spray rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS Word DOCX with Many ActiveX Objects and Media rev 7 2024-03-13
suricata ET WEB_SERVER WebShell - Generic - GIF Header With HTML Form rev 6 2024-03-13
suricata ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access postToSocial rev 4 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated JS - URL Encoded Unescape Function Call Inbound rev 5 2024-03-13
suricata ET ACTIVEX Possible NET-i viewer ActiveX Control BackupToAvi Method Access Buffer Overflow 2 rev 7 2024-03-13
suricata ET ACTIVEX Possible SkinCrafter ActiveX Control InitLicenKeys Method Access Buffer Overflow 2 rev 5 2024-03-13
suricata ET EXPLOIT_KIT DRIVEBY SweetOrange - Java Exploit Downloaded rev 7 2024-03-13
suricata ET INFO Embedded Executable File in PDF - This Program Cannot Be Run in DOS Mode rev 8 2024-03-13
suricata ET MALWARE Possible Metasploit Java Payload rev 6 2024-03-13
suricata ET SHELLCODE Possible UTF-16 u9090 NOP SLED rev 5 2024-03-13
suricata ET ACTIVEX Possible NET-i viewer ActiveX Control BackupToAvi Method Access Buffer Overflow rev 8 2024-03-13
suricata ET WEB_SERVER WebShell - Generic - c99shell based header rev 4 2024-03-13
suricata ET ACTIVEX Quest Explain Plan Display ActiveX Control SaveToFile Insecure Method Access 2 rev 4 2024-03-13
suricata ET EXPLOIT_KIT Unknown EK Landing Page rev 3 2024-03-13
suricata ET WEB_CLIENT c3284d malware network iframe rev 5 2024-03-13
suricata ET MALWARE Hiloti/Mufanom CnC Response rev 4 2024-03-13
suricata ET MALWARE CommentCrew Possible APT crabdance backdoor base64 head 2 rev 5 2024-03-13
suricata ET ACTIVEX winhlp32 ActiveX control attack - phase 3 rev 16 2024-03-13
suricata ET MALWARE Drive Receiving IP2 DDoS instructions rev 5 2024-03-13
suricata ET WEB_SERVER ATTACKER WebShell - Zehir4.asp - content rev 3 2024-03-13
suricata ET MALWARE Cryptmen FakAV page Title rev 3 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdExport Method Access Buffer Overflow 2 rev 5 2024-03-13
suricata ET MALWARE RevProxy Java Settings rev 4 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated Eval String 7 rev 4 2024-03-13
suricata ET MALWARE Drive Receiving POST1 DDoS instructions rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - PHPShell - Comment rev 3 2024-03-13
suricata ET EXPLOIT Metasploit -Java Atomic Exploit Downloaded rev 3 2024-03-13
suricata ET MALWARE WEBC2-TABLE Checkin Response - Embedded CnC APT1 Related rev 3 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated Eval String 2 rev 4 2024-03-13
suricata ET ACTIVEX Tracker Software pdfSaver ActiveX InitFromRegistry Method Access Potential Buffer Overflow rev 5 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated Eval String 4 rev 4 2024-03-13
suricata ET WEB_SERVER ATTACKER WebShell - PHP Offender - Title rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - JSP RAT rev 4 2024-03-13
suricata ET ACTIVEX Possible Aloaha PDF Crypter activex SaveToFile method arbitrary file overwrite rev 4 2024-03-13