Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET HUNTING Possible REvil 0day Exploitation Activity Inbound rev 2 2024-03-08
suricata GPL RPC portmap ttdbserv request TCP rev 20 2024-03-08
suricata GPL NETBIOS DCERPC Workstation Service direct service bind attempt rev 8 2024-03-08
suricata GPL NETBIOS SMB NTLMSSP invalid mechlistMIC attempt rev 12 2024-03-08
suricata GPL MISC CVS double free exploit attempt response rev 6 2024-03-08
suricata ET MALWARE W32.Geodo/Emotet Checkin Fake 404 Response rev 5 2024-03-08
suricata GPL FTP RMD overflow attempt rev 11 2024-03-08
suricata GPL CHAT Google Talk Logon rev 5 2024-03-08
suricata GPL FTP saint scan rev 9 2024-03-08
suricata ET WEB_CLIENT Tech Support Scam - Windows Firewall M1 2021-08-17 rev 2 2024-03-08
suricata GPL RPC portmap cmsd request TCP rev 11 2024-03-08
suricata GPL WEB_SERVER service.cnf access rev 14 2024-03-08
suricata ET WEB_SERVER Common JSP WebShell String Observed in HTTP Header M1 rev 3 2024-03-08
suricata GPL RPC portmap ypupdated request TCP rev 12 2024-03-08
suricata GPL WEB_SERVER viewcode access rev 13 2024-03-08
suricata ET SCADA [nsacyber/ELITEWOLF] Siemens S7 Redpoint NSE Request CPU Function Read SZL attempt rev 2 2024-03-08
suricata GPL SCAN ssh-research-scanner rev 6 2024-03-08
suricata ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved rev 3 2024-03-08
suricata ET MALWARE Backdoor.Win32.Agent.myttae User-Agent rev 3 2024-03-08
suricata ET MALWARE Win32/RisePro CnC Server Response M1 rev 2 2024-03-08
suricata GPL TELNET Bad Login rev 11 2024-03-08
suricata GPL WEB_SERVER Tomcat server snoop access rev 15 2024-03-08
suricata GPL MISC rwhoisd format string attempt rev 8 2024-03-08
suricata GPL FTP CWD ... rev 9 2024-03-08
suricata GPL RPC rlogin LinuxNIS rev 8 2024-03-08
suricata GPL CHAT Jabber/Google Talk Outoing Message rev 4 2024-03-08
suricata GPL NETBIOS SMB-DS DCERPC NTLMSSP invalid mechlistMIC attempt rev 13 2024-03-08
suricata GPL CHAT Jabber/Google Talk Logon Success rev 4 2024-03-08
suricata GPL WEB_SERVER author.exe access rev 11 2024-03-08
suricata GPL MISC HP Web JetAdmin file write attempt rev 3 2024-03-08
suricata GPL FTP STOU overflow attempt rev 6 2024-03-08
suricata GPL SQL MSSQL shellcode attempt 2 rev 8 2024-03-08
suricata ET MALWARE Stealbit Variant Data Exfil M1 rev 5 2024-03-08
suricata GPL RPC portmap listing TCP 111 rev 14 2024-03-08
suricata GPL NETBIOS DCERPC Remote Activation bind attempt rev 17 2024-03-08
suricata ET PHISHING Observed OneDrive Phishing Landing Page 2021-08-09 rev 2 2024-03-08
suricata GPL SQL sa brute force failed login attempt rev 5 2024-03-08
suricata GPL FTP CWD ~<CR><NEWLINE> attempt rev 10 2024-03-08
suricata GPL SCAN adm scan rev 8 2024-03-08
suricata GPL RPC portmap amountd request TCP rev 13 2024-03-08