Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE MICROPSIA Screenshot Upload M3 rev 2 2024-03-08
suricata ET USER_AGENTS Suspicious User-Agent Sample rev 7 2024-03-08
suricata ET INFO Observed Let's Encrypt Certificate from Retired Intermediate rev 3 2024-03-08
suricata GPL NETBIOS NT NULL session rev 12 2024-03-08
suricata GPL EXPLOIT rsh froot rev 8 2024-03-08
suricata GPL RPC rexec username too long response rev 7 2024-03-08
suricata GPL SQL MYSQL root login attempt rev 5 2024-03-08
suricata ET PHISHING Meta Credential Phish Landing Page 2024-01-08 rev 2 2024-03-08
suricata GPL FTP satan scan rev 9 2024-03-08
suricata GPL MISC CVS double free exploit attempt response rev 6 2024-03-08
suricata GPL WEB_SPECIFIC_APPS PHPNuke Forum viewtopic SQL insertion attempt rev 8 2024-03-08
suricata GPL RPC portmap proxy attempt TCP rev 8 2024-03-08
suricata GPL RPC rlogin login failure rev 9 2024-03-08
suricata GPL MISC CVS invalid directory response rev 6 2024-03-08
suricata ET USER_AGENTS ErbiumStealer UA Observed rev 2 2024-03-08
suricata GPL EXPLOIT ISAPI .idq attempt rev 18 2024-03-08
suricata GPL MISC CVS invalid module response rev 4 2024-03-08
suricata GPL FTP SITE ZIPCHK overflow attempt rev 8 2024-03-08
suricata GPL SMTP expn decode rev 11 2024-03-08
suricata GPL FTP invalid MODE rev 8 2024-03-08
suricata ET WEB_CLIENT Tech Support Scam - Windows Firewall M5 2021-08-17 rev 2 2024-03-08
suricata GPL SMTP RCPT TO overflow rev 18 2024-03-08
suricata GPL INFO PCAnywhere Attempted Administrator Login rev 6 2024-03-08
suricata ET WEB_SERVER Common JSP WebShell String Observed in HTTP Header M2 rev 3 2024-03-08
suricata GPL WEB_SERVER python access attempt rev 12 2024-03-08
suricata ET MALWARE xCaon Embedded Encrypted Command in Webpage rev 3 2024-03-08
suricata GPL NETBIOS SMB startup folder unicode access rev 6 2024-03-08
suricata GPL WEB_SERVER /~root access rev 12 2024-03-08
suricata GPL FTP CWD ~root attempt rev 12 2024-03-08
suricata GPL RPC portmap UNSET attempt TCP 111 rev 7 2024-03-08
suricata GPL TELNET root login rev 10 2024-03-08
suricata ET HUNTING Possible REvil 0day Exploitation Activity Inbound rev 2 2024-03-08
suricata GPL NETBIOS SMB Session Setup AndX request username overflow attempt rev 6 2024-03-08
suricata GPL WEB_SERVER iisadmin access rev 15 2024-03-08
suricata ET WEB_SERVER SLIGHTPULSE WebShell Access Inbound M3 rev 2 2024-03-08
suricata GPL MISC rsh froot rev 7 2024-03-08
suricata GPL SQL xp_cmdshell program execution rev 8 2024-03-08
suricata ET MALWARE Win32/RisePro CnC Server Response M5 rev 3 2024-03-08
suricata GPL IMAP EXPLOIT partial body overflow attempt rev 11 2024-03-08
suricata GPL EXPLOIT CodeRed v2 root.exe access rev 12 2024-03-08