Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata GPL EXPLOIT WEB-MISC JBoss RMI class download service directory listing attempt rev 2 2024-03-08
suricata GPL SQL service_name buffer overflow attempt rev 4 2024-03-08
suricata GPL FTP authorized_keys file transferred rev 8 2024-03-08
suricata GPL EXPLOIT CodeRed v2 root.exe access rev 12 2024-03-08
suricata GPL NETBIOS SMB DCERPC invalid bind attempt rev 5 2024-03-08
suricata GPL NETBIOS SMB-DS DCERPC Messenger Service buffer overflow attempt rev 11 2024-03-08
suricata GPL EXPLOIT rsyncd module list access rev 4 2024-03-08
suricata GPL FTP NLST overflow attempt rev 8 2024-03-08
suricata GPL WEB_SERVER viewcode access rev 13 2024-03-08
suricata GPL MISC CVS double free exploit attempt response rev 6 2024-03-08
suricata GPL SQL Oracle iSQLPlus login.uix username overflow attempt rev 8 2024-03-08
suricata GPL RPC snmpXdmi overflow attempt TCP rev 16 2024-03-08
suricata GPL SQL sa login failed rev 12 2024-03-08
suricata GPL NETBIOS DCERPC Workstation Service direct service bind attempt rev 8 2024-03-08
suricata GPL FTP PASS overflow attempt rev 19 2024-03-08
suricata GPL WEB_SERVER python access attempt rev 12 2024-03-08
suricata GPL WEB_SERVER service.cnf access rev 14 2024-03-08
suricata GPL FTP APPE overflow attempt rev 12 2024-03-08
suricata ET SCADA [nsacyber/ELITEWOLF] Siemens S7 Redpoint NSE Request CPU Function Read SZL attempt rev 2 2024-03-08
suricata GPL FTP USER overflow attempt rev 37 2024-03-08
suricata GPL FTP CWD ~root attempt rev 12 2024-03-08
suricata GPL FTP RMD overflow attempt rev 11 2024-03-08
suricata ET WEB_SERVER Common JSP WebShell String Observed in HTTP Header M2 rev 3 2024-03-08
suricata GPL RPC portmap admind request TCP rev 11 2024-03-08
suricata GPL RPC portmap cmsd request TCP rev 11 2024-03-08
suricata GPL SMTP RCPT TO overflow rev 18 2024-03-08
suricata GPL CHAT Google Talk Logon rev 5 2024-03-08
suricata GPL WEB_SERVER iisadmin access rev 15 2024-03-08
suricata GPL EXPLOIT rsh bin rev 7 2024-03-08
suricata GPL CHAT Jabber/Google Talk Incoming Message rev 4 2024-03-08
suricata GPL EXPLOIT xp_sprintf possible buffer overflow rev 11 2024-03-08
suricata GPL NETBIOS SMB repeated logon failure rev 5 2024-03-08
suricata GPL EXPLOIT cmd? access rev 13 2024-03-08
suricata ET WEB_SERVER Common JSP WebShell String Observed in HTTP Header M1 rev 3 2024-03-08
suricata GPL WEB_SERVER global.asa access rev 17 2024-03-08
suricata GPL DNS named authors attempt rev 9 2024-03-08
suricata GPL NETBIOS NT NULL session rev 12 2024-03-08
suricata ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL FTP Server Activity - Change working directory 2701 rev 2 2024-03-08
suricata ET WEB_SERVER SLIGHTPULSE WebShell Access Inbound M3 rev 2 2024-03-08
suricata ET MALWARE Webshell Landing Outbound - Possibly Iran-based rev 2 2024-03-08