Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET ATTACK_RESPONSE Obfuscated Eval String 7 rev 4 2024-03-13
suricata ET WEB_SERVER WebShell Generic eval of gzuncompress rev 9 2024-03-13
suricata ET MALWARE Drive Receiving GET DDoS instructions rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Importing tracing Provider Factory rev 3 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdOpen Method Access Buffer Overflow rev 5 2024-03-13
suricata ET MALWARE Darkness DDoS HTTP Target/EXE rev 8 2024-03-13
suricata ET WEB_SERVER WebShell - Romanian Webshell rev 5 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated Eval String 6 rev 4 2024-03-13
suricata ET HUNTING PDF Containing Subform with JavaScript rev 7 2024-03-13
suricata ET MOBILE_MALWARE Android.KorBanker Successful Fake Banking App Install CnC Server Acknowledgement rev 4 2024-03-13
suricata ET WEB_CLIENT Fake Adobe Flash Player update warning enticing clicks to malware payload rev 5 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdOpen Method Access Buffer Overflow 2 rev 5 2024-03-13
suricata ET EXPLOIT Metasploit mstime_malloc no-spray rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Mozilla JS Class Creation rev 4 2024-03-13
suricata ET P2P BitTorrent - Torrent File Downloaded rev 6 2024-03-13
suricata ET HUNTING Suspicious Possible CollectGarbage in base64 1 rev 4 2024-03-13
suricata ET SCAN Possible WordPress xmlrpc.php BruteForce in Progress - Response rev 6 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class B64 encoded class rev 3 2024-03-13
suricata ET WEB_SERVER WEBSHELL CFM Shell Access rev 3 2024-03-13
suricata ET ACTIVEX Quest Explain Plan Display ActiveX Control SaveToFile Insecure Method Access rev 4 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated JS - URL Encoded Unescape Function Call Inbound rev 5 2024-03-13
suricata ET ACTIVEX Possible Windows Live Writer ActiveX BlogThisLink Method Access Denail of Service Attack 2 rev 6 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Lang Runtime in Response rev 4 2024-03-13
suricata ET ATTACK_RESPONSE WSO - WebShell Activity - WSO Title rev 4 2024-03-13
suricata ET ACTIVEX Tracker Software pdfSaver ActiveX StoreInRegistry Method Access Potential Buffer Overflow rev 5 2024-03-13
suricata ET MALWARE W32/Eclipse.DDOSBot CnC Beacon Response rev 4 2024-03-13
suricata ET MALWARE WEBC2-QBP Checkin Response 1 - Embedded CnC APT1 Related rev 4 2024-03-13
suricata ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access sendSMS rev 4 2024-03-13
suricata ET MALWARE DaoDao Cloud Loader C2 Response rev 1 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Importing jmx mbeanserver rev 3 2024-03-13
suricata ET ACTIVEX Possible Windows Live Writer ActiveX BlogThisLink Method Access Denail of Service Attack rev 6 2024-03-13
suricata ET MALWARE TA416 Related PUBLOAD Variant Checkin Activity M2 rev 1 2024-03-13
suricata ET ACTIVEX Possible NET-i viewer ActiveX Control ConnectDDNS Method Access Code Execution Vulnerability rev 7 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class file Accessing Security Manager rev 3 2024-03-13
suricata ET WEB_CLIENT DRIVEBY Social Engineering Toolkit Web Clone code detected rev 3 2024-03-13
suricata ET ACTIVEX Possible Sony PC Companion CheckCompatibility method Stack-based Unicode Buffer Overload rev 4 2024-03-13
suricata ET EXPLOIT_KIT Unknown_MM - Payload Download rev 3 2024-03-13
suricata ET ACTIVEX Possible Samsung Kies ActiveX PrepareSync method Buffer overflow rev 4 2024-03-13
suricata ET MALWARE Win32/Enchanim Check-in Response rev 4 2024-03-13
suricata ET EXPLOIT_KIT Possible WhiteLotus EK 2013-2551 Exploit 1 rev 5 2024-03-13