Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET PHISHING IRS Phishing Landing 2016-01-15 rev 6 2024-03-07
suricata ET PHISHING Google Drive Phish Landing 2016-09-01 rev 4 2024-03-07
suricata ET MALWARE [eSentire] Win32/Spy.Banker.ADIO CnC Checkin rev 2 2024-03-07
sigma Active Directory Certificate Services Denied Certificate Enrollment Request test 2024-03-07
sigma Potential PowerShell Execution Via DLL test 2024-03-07
sigma Potential Raspberry Robin CPL Execution Activity test 2024-03-07
sigma Github Push Protection Disabled test 2024-03-07
sigma Github Push Protection Bypass Detected test 2024-03-07
snort ET INFO Windows Scheduled Task XML Response from Server rev 1 2024-03-06
snort ET TROJAN TA421 Wineloader CnC Checkin M2 rev 1 2024-03-06
snort ET TROJAN Bitter APT Activity - Secondary Payload Retrieval Attempt rev 1 2024-03-06
suricata ET WEB_SERVER c99 Shell Backdoor Var Override URI rev 5 2024-03-06
suricata ET WEB_SERVER Possible MySQL SQLi Attempt Information Schema Access rev 4 2024-03-06
suricata ET WEB_SPECIFIC_APPS Bugzilla token.cgi HPP e-mail validation bypass Attempt Client Body rev 8 2024-03-06
suricata ET WEB_SPECIFIC_APPS RealtyListings type.asp iType Parameter SQL Injection rev 7 2024-03-06
suricata ET WEB_SPECIFIC_APPS DeZine DZcms products.php pcat parameter SQL injection rev 8 2024-03-06
suricata ET WEB_SPECIFIC_APPS Cyphor show.php SQL injection attempt rev 10 2024-03-06
suricata ET INFO HTTP Request to a *.ae.am domain rev 5 2024-03-06
suricata ET INFO Unsupported/Fake Windows NT Version 4. rev 6 2024-03-06
suricata ET INFO HTTP Request to a *.upas.su domain rev 6 2024-03-06
suricata ET HUNTING SUSPICIOUS *.pdf.exe in HTTP URL rev 4 2024-03-06
suricata ET WEB_SPECIFIC_APPS ParsBlogger blog.asp wr parameter Remote SQL Injection rev 7 2024-03-06
suricata ET WEB_SPECIFIC_APPS PozScripts Classified Auctions id parameter SQL Injection rev 7 2024-03-06
suricata ET WEB_SPECIFIC_APPS AjaxPortal ajaxp_backend.php page Parameter SQL Injection rev 8 2024-03-06
suricata ET MALWARE Win32/Neutrino Bot Fake 404 Checkin Response rev 5 2024-03-06
suricata ET WEB_SPECIFIC_APPS TurnkeyForms Business Survey Pro id parameter SQL Injection rev 7 2024-03-06
suricata ET INFO HTTP Request to a *.c0m.li domain rev 5 2024-03-06
suricata ET EXPLOIT Linksys Auth Bypass share_editor.cgi rev 4 2024-03-06
suricata ET MALWARE Bifrose Response from Controller rev 5 2024-03-06
suricata ET HUNTING SUSPICIOUS XXTEA UTF-16 Encoded HTTP Response rev 3 2024-03-06
suricata ET WEB_SPECIFIC_APPS ECShop user.php order_sn Parameter SQL Injection rev 7 2024-03-06
suricata ET MALWARE W32/ZxShell Server Checkin Response rev 2 2024-03-06
suricata ET MALWARE Linux/dtool IRC Command Complete 3 rev 4 2024-03-06
suricata ET INFO RemoteControlX rctrlx service created rev 3 2024-03-06
suricata ET WEB_SPECIFIC_APPS Nitrotech members.php id Parameter SQL Injection rev 7 2024-03-06
suricata ET SCAN Springenwerk XSS Scanner User-Agent Detected rev 7 2024-03-06
suricata ET INFO HTTP Request to a *.co.com.au domain rev 5 2024-03-06
suricata ET WEB_SPECIFIC_APPS Kalptaru Infotech Automated Link Exchange Portal cat_id Parameter SQL Injection rev 8 2024-03-06
suricata ET INFO Unsupported/Fake Windows NT Version 5.0 rev 6 2024-03-06
suricata ET WEB_SPECIFIC_APPS Venalsur Booking Centre HotelID Parameter SQL Injection rev 7 2024-03-06