Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata GPL RPC portmap cmsd request TCP rev 11 2024-03-08
suricata GPL FTP CWD ~root attempt rev 12 2024-03-08
suricata GPL MISC ident version request rev 6 2024-03-08
suricata GPL MISC CVS invalid directory response rev 6 2024-03-08
suricata GPL ATTACK_RESPONSE del attempt rev 10 2024-03-08
suricata GPL SQL Oracle iSQLPlus login.uix username overflow attempt rev 8 2024-03-08
suricata ET MOBILE_MALWARE PJobRat System Exfil to CnC rev 2 2024-03-08
suricata GPL MISC CVS invalid module response rev 4 2024-03-08
suricata GPL INFO PCAnywhere Attempted Administrator Login rev 6 2024-03-08
suricata GPL EXPLOIT cmd? access rev 13 2024-03-08
suricata GPL FTP APPE overflow attempt rev 12 2024-03-08
suricata GPL NETBIOS SMB Session Setup AndX request username overflow attempt rev 6 2024-03-08
suricata GPL MISC CVS double free exploit attempt response rev 6 2024-03-08
suricata GPL WEB_SPECIFIC_APPS PHPNuke Forum viewtopic SQL insertion attempt rev 8 2024-03-08
suricata GPL RPC portmap UNSET attempt TCP 111 rev 7 2024-03-08
suricata ET INFO Observed Let's Encrypt Certificate from Retired Intermediate rev 3 2024-03-08
suricata ET MALWARE Win32/Nitol.A CnC Checkin M3 rev 2 2024-03-08
suricata GPL EXPLOIT rsh froot rev 8 2024-03-08
suricata GPL FTP PASS overflow attempt rev 19 2024-03-08
suricata ET INFO Chisel SOCKS Proxy Startup Observed rev 2 2024-03-08
suricata GPL POP3 AUTH overflow attempt rev 10 2024-03-08
suricata ET MALWARE Observed Malsmoke Staging Domain in SNI rev 2 2024-03-08
suricata GPL FTP CWD ... rev 9 2024-03-08
suricata GPL FTP STOU overflow attempt rev 6 2024-03-08
suricata ET WEB_SPECIFIC_APPS GL.iNet add_user API Request - Backdoor root User Attempt rev 2 2024-03-08
suricata GPL P2P eDonkey server response rev 5 2024-03-08
suricata GPL CHAT Jabber/Google Talk Outoing Message rev 4 2024-03-08
suricata GPL WEB_SERVER Tomcat server snoop access rev 15 2024-03-08
suricata ET PHISHING Observed Zimbra Phishing Landing Page 2021-08-09 rev 2 2024-03-08
suricata ET WEB_CLIENT Tech Support Scam - Windows Firewall M3 2021-08-17 rev 2 2024-03-08
suricata ET USER_AGENTS ABBCCoin Activity Observed rev 3 2024-03-08
suricata ET INFO Powershell Base64 Decode Command Inbound rev 2 2024-03-08
suricata GPL POP3 APOP overflow attempt rev 15 2024-03-08
suricata GPL RPC portmap ypserv request TCP rev 16 2024-03-08
suricata GPL FTP piss scan rev 9 2024-03-08
suricata GPL NETBIOS SMB-DS DCERPC Workstation Service unicode bind attempt rev 10 2024-03-08
suricata GPL SCAN ssh-research-scanner rev 6 2024-03-08
suricata ET MALWARE Win32/Gamaredon CnC Activity rev 2 2024-03-08
suricata GPL FTP RNFR overflow attempt rev 3 2024-03-08
suricata GPL RPC tooltalk TCP overflow attempt rev 10 2024-03-08