Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET SCADA [nsacyber/ELITEWOLF] Siemens S7 Redpoint NSE Request CPU Function Read SZL attempt rev 2 2024-03-08
suricata GPL NETBIOS DCERPC Workstation Service direct service bind attempt rev 8 2024-03-08
suricata GPL SQL Oracle iSQLPlus login.uix username overflow attempt rev 8 2024-03-08
suricata ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - Change working directory 2701 rev 2 2024-03-08
suricata GPL FTP USER overflow attempt rev 37 2024-03-08
suricata GPL RPC portmap ttdbserv request TCP rev 20 2024-03-08
suricata GPL CHAT Jabber/Google Talk Incoming Message rev 4 2024-03-08
suricata GPL MISC CVS double free exploit attempt response rev 6 2024-03-08
suricata GPL FTP satan scan rev 9 2024-03-08
suricata ET WEB_SERVER Common JSP WebShell String Observed in HTTP Header M1 rev 3 2024-03-08
suricata GPL NETBIOS SMB repeated logon failure rev 5 2024-03-08
suricata ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved rev 3 2024-03-08
suricata ET MALWARE Backdoor.Win32.Agent.myttae User-Agent rev 3 2024-03-08
suricata GPL FTP pass wh00t rev 9 2024-03-08
suricata GPL INFO PCAnywhere Failed Login rev 6 2024-03-08
suricata ET MALWARE W32.Geodo/Emotet Checkin Fake 404 Response rev 5 2024-03-08
suricata GPL IMAP Overflow Attempt rev 9 2024-03-08
suricata ET INFO Observed Let's Encrypt Certificate from Retired Intermediate rev 3 2024-03-08
suricata GPL RPC portmap admind request TCP rev 11 2024-03-08
suricata GPL FTP invalid MODE rev 8 2024-03-08
suricata GPL CHAT Google Talk Logon rev 5 2024-03-08
suricata GPL EXPLOIT rsh bin rev 7 2024-03-08
suricata GPL RPC portmap ypupdated request TCP rev 12 2024-03-08
suricata GPL WEB_SERVER global.asa access rev 17 2024-03-08
suricata GPL RPC portmap proxy attempt TCP rev 8 2024-03-08
suricata GPL EXPLOIT xp_sprintf possible buffer overflow rev 11 2024-03-08
suricata GPL FTP MDTM overflow attempt rev 8 2024-03-08
suricata GPL NETBIOS SMB-DS DCERPC NTLMSSP invalid mechlistMIC attempt rev 13 2024-03-08
suricata GPL FTP CWD ... rev 9 2024-03-08
suricata GPL P2P eDonkey server response rev 5 2024-03-08
suricata GPL RPC portmap yppasswd request TCP rev 12 2024-03-08
suricata GPL EXPLOIT ISAPI .idq attempt rev 18 2024-03-08
suricata GPL CHAT Jabber/Google Talk Logon Success rev 4 2024-03-08
suricata GPL CHAT Jabber/Google Talk Outoing Message rev 4 2024-03-08
suricata ET PHISHING Observed OneDrive Phishing Landing Page 2021-08-09 rev 2 2024-03-08
suricata GPL MISC rwhoisd format string attempt rev 8 2024-03-08
suricata ET WEB_CLIENT Tech Support Scam - Windows Firewall M5 2021-08-17 rev 2 2024-03-08
suricata GPL RPC portmap listing TCP 111 rev 14 2024-03-08
suricata ET MALWARE Observed Malsmoke Staging Domain in SNI rev 2 2024-03-08
suricata GPL SMTP vrfy root rev 8 2024-03-08