Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata GPL CHAT Google Talk Logon rev 5 2024-03-08
suricata ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved rev 3 2024-03-08
suricata ET MALWARE MICROPSIA Screenshot Upload M3 rev 2 2024-03-08
suricata GPL RPC sadmind query with root credentials attempt TCP rev 6 2024-03-08
suricata GPL WEB_SERVER apache ?M=D directory list attempt rev 13 2024-03-08
suricata GPL NETBIOS SMB-DS repeated logon failure rev 5 2024-03-08
suricata GPL INFO PCAnywhere Failed Login rev 6 2024-03-08
suricata GPL DNS named authors attempt rev 9 2024-03-08
suricata GPL RPC portmap cachefsd request TCP rev 13 2024-03-08
suricata GPL NETBIOS SMB NTLMSSP invalid mechlistMIC attempt rev 12 2024-03-08
suricata GPL RPC portmap sadmind request TCP rev 12 2024-03-08
suricata ET WEB_SERVER Common JSP WebShell String Observed in HTTP Header M1 rev 3 2024-03-08
suricata GPL WEB_SERVER iisadmin access rev 15 2024-03-08
suricata GPL NETBIOS DCERPC Workstation Service direct service bind attempt rev 8 2024-03-08
suricata GPL FTP USER overflow attempt rev 37 2024-03-08
suricata ET WEB_SERVER SLIGHTPULSE WebShell Access Inbound M3 rev 2 2024-03-08
suricata GPL FTP SITE NEWER overflow attempt rev 9 2024-03-08
suricata ET ATTACK_RESPONSE Possible PowerShell AMSI Bypass Inbound rev 2 2024-03-08
suricata GPL WEB_SERVER python access attempt rev 12 2024-03-08
suricata ET WEB_CLIENT Tech Support Scam - Windows Firewall M1 2021-08-17 rev 2 2024-03-08
suricata GPL MISC rsh root rev 7 2024-03-08
suricata ET MALWARE W32.Geodo/Emotet Checkin Fake 404 Response rev 5 2024-03-08
suricata GPL WEB_SERVER globals.pl access rev 8 2024-03-08
suricata GPL NETBIOS SMB startup folder access rev 7 2024-03-08
suricata GPL FTP saint scan rev 9 2024-03-08
suricata GPL WEB_SERVER service.cnf access rev 14 2024-03-08
suricata GPL FTP CWD Root directory transversal attempt rev 11 2024-03-08
suricata GPL WEB_SERVER viewcode access rev 13 2024-03-08
suricata GPL CHAT Jabber/Google Talk Incoming Message rev 4 2024-03-08
suricata GPL SMTP RCPT TO overflow rev 18 2024-03-08
suricata GPL SQL sa brute force failed login unicode attempt rev 5 2024-03-08
suricata GPL NETBIOS SMB repeated logon failure rev 5 2024-03-08
suricata ET MALWARE Backdoor.Win32.Agent.myttae User-Agent rev 3 2024-03-08
suricata GPL SQL sp_start_job - program execution rev 7 2024-03-08
suricata ET MALWARE Win32/RisePro CnC Server Response M1 rev 2 2024-03-08
suricata GPL NETBIOS SMB DCERPC Workstation Service unicode bind attempt rev 8 2024-03-08
suricata ET MALWARE Win32/RisePro CnC Server Response M5 rev 3 2024-03-08
suricata GPL EXPLOIT WEB-MISC JBoss RMI class download service directory listing attempt rev 2 2024-03-08
suricata GPL MISC rsh froot rev 7 2024-03-08
suricata GPL FTP MKD overflow rev 14 2024-03-08