Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET WEB_CLIENT DRIVEBY Redirection - Wordpress Injection rev 3 2024-03-13
suricata ET MALWARE Galock Ransomware Command rev 4 2024-03-13
suricata ET WEB_SERVER WebShell - JSPCMD - Form rev 3 2024-03-13
suricata ET INFO PDF /FlateDecode and PDF version 1.0 rev 4 2024-03-13
suricata ET SHELLCODE Hex Obfuscated JavaScript Heap Spray 0b0b0b0b rev 5 2024-03-13
suricata ET MALWARE W32/NSISDL.Downloader CnC Server Response rev 3 2024-03-13
suricata ET EXPLOIT_KIT BegOpEK - Landing Page rev 4 2024-03-13
suricata ET MALWARE APT_NGO_wuaclt PDF file rev 3 2024-03-13
suricata ET WEB_SERVER WebShell - GODSpy - GOD Hacker rev 3 2024-03-13
suricata ET WEB_SERVER WebShell Generic eval of base64_decode rev 9 2024-03-13
suricata ET ACTIVEX Possible LEADTOOLS ActiveX Raster Twain AppName Method Access Buffer Overflow rev 5 2024-03-13
suricata ET INFO Android Dalvik Executable File Download rev 3 2024-03-13
suricata ET ACTIVEX Possible Sony PC Companion Admin_RemoveDirectory Stack-based Unicode Buffer Overload SEH rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Importing management MBeanServer rev 3 2024-03-13
suricata ET ACTIVEX Possible Cyme ChartFX client server ActiveX Control ShowPropertiesDialog arbitrary code execution rev 4 2024-03-13
suricata ET HUNTING SUSPICIOUS Reassigned Eval Function 2 rev 4 2024-03-13
suricata ET EXPLOIT_KIT CritXPack - Landing Page - Received rev 3 2024-03-13
suricata ET ACTIVEX Tracker Software pdfSaver ActiveX InitFromRegistry Method Access Potential Buffer Overflow rev 5 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated Eval String 2 rev 4 2024-03-13
suricata ET ATTACK_RESPONSE Obfuscated Eval String 4 rev 4 2024-03-13
suricata ET MALWARE CommentCrew Possible APT c2 communications sleep rev 4 2024-03-13
suricata ET MALWARE WEBC2-TABLE Checkin Response - Embedded CnC APT1 Related rev 3 2024-03-13
suricata ET EXPLOIT_KIT Unknown_MM - Payload Download rev 3 2024-03-13
suricata ET EXPLOIT_KIT Exploit Kit Delivering JAR Archive to Client rev 4 2024-03-13
suricata ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access sendSMS rev 4 2024-03-13
suricata ET MALWARE DaoDao Cloud Loader C2 Response rev 1 2024-03-13
suricata ET HUNTING SUSPICIOUS Java Request With Uncompressed JAR/Class Importing jmx mbeanserver rev 3 2024-03-13
suricata ET HUNTING SUSPICIOUS Reassigned Eval Function 3 rev 4 2024-03-13
suricata ET WEB_SERVER WebShell ASPXShell - Title rev 6 2024-03-13
suricata ET WEB_SERVER WebShell - Generic - c99shell based header rev 3 2024-03-13
suricata ET EXPLOIT Metasploit js_property_spray sprayHeap rev 4 2024-03-13
suricata ET EXPLOIT_KIT JDB Exploit Kit Landing Page rev 7 2024-03-13
suricata ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdSave Method Access Buffer Overflow 2 rev 5 2024-03-13
sigma Network Connection Initiated By PowerShell Process test 2024-03-13
sigma Changing Existing Service ImagePath Value Via Reg.EXE test 2024-03-13
sigma Potential Regsvr32 Commandline Flag Anomaly test 2024-03-13
sigma Exports Critical Registry Keys To a File test 2024-03-13
sigma Exports Registry Key To a File test 2024-03-13
sigma Imports Registry Key From a File test 2024-03-13
sigma Imports Registry Key From an ADS test 2024-03-13