Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET USER_AGENTS ErbiumStealer UA Observed rev 2 2024-03-08
suricata GPL SQL shellcode attempt rev 8 2024-03-08
suricata ET PHISHING Observed Zimbra Phishing Landing Page 2021-08-09 rev 2 2024-03-08
suricata ET WEB_SPECIFIC_APPS GL.iNet add_user API Request - Backdoor root User Attempt rev 2 2024-03-08
suricata GPL WEB_SERVER Oracle Java Process Manager access rev 7 2024-03-08
suricata GPL RPC portmap yppasswd request TCP rev 12 2024-03-08
suricata ET USER_AGENTS Suspicious User-Agent Sample rev 7 2024-03-08
suricata ET PHISHING Observed OneDrive Phishing Landing Page 2021-08-09 rev 2 2024-03-08
suricata GPL WEB_SERVER Tomcat null byte directory listing attempt rev 9 2024-03-08
suricata GPL NETBIOS SMB-DS DCERPC NTLMSSP invalid mechlistMIC attempt rev 13 2024-03-08
suricata GPL RPC rlogin LinuxNIS rev 8 2024-03-08
suricata GPL FTP MDTM overflow attempt rev 8 2024-03-08
suricata GPL SQL connect_data remote version detection attempt rev 7 2024-03-08
suricata GPL CHAT Jabber/Google Talk Logon Success rev 4 2024-03-08
suricata GPL RPC portmap proxy integer overflow attempt TCP rev 7 2024-03-08
suricata GPL EXPLOIT ISAPI .idq attempt rev 18 2024-03-08
suricata ET WEB_CLIENT Tech Support Scam - Windows Firewall M5 2021-08-17 rev 2 2024-03-08
suricata GPL FTP iss scan rev 9 2024-03-08
suricata GPL RPC portmap selection_svc request TCP rev 12 2024-03-08
suricata GPL EXPLOIT rsyncd module list access rev 4 2024-03-08
suricata GPL FTP authorized_keys file transferred rev 8 2024-03-08
suricata GPL FTP CWD ~ attempt rev 13 2024-03-08
suricata ET PHISHING Successful TA399/Sidewinder Related Phish 2022-09-28 rev 2 2024-03-08
suricata GPL SQL service_name buffer overflow attempt rev 4 2024-03-08
suricata GPL FTP large PWD command rev 10 2024-03-08
suricata GPL MISC rlogin bin rev 7 2024-03-08
suricata ET USER_AGENTS Shadowcoin Cryptocurrency UA Observed rev 3 2024-03-08
suricata ET MALWARE Win32/RisePro CnC Server Response M5 rev 3 2024-03-08
suricata GPL FTP DELE overflow attempt rev 10 2024-03-08
suricata GPL EXPLOIT CodeRed v2 root.exe access rev 12 2024-03-08
suricata GPL EXPLOIT ISAPI .idq access rev 14 2024-03-08
suricata GPL SCAN adm scan rev 8 2024-03-08
suricata GPL SMTP vrfy root rev 8 2024-03-08
suricata GPL FTP CWD ~<CR><NEWLINE> attempt rev 10 2024-03-08
suricata ET MALWARE Stealbit Variant Data Exfil M1 rev 5 2024-03-08
suricata GPL RPC portmap bootparam request TCP rev 15 2024-03-08
suricata GPL WEB_SERVER service.pwd rev 11 2024-03-08
suricata ET PHISHING Spox Phishkit Landing Page Inbound rev 2 2024-03-08
suricata GPL DNS named authors attempt rev 9 2024-03-08
suricata GPL NETBIOS SMB-DS repeated logon failure rev 5 2024-03-08