Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE DirectsX Checkin Response rev 4 2024-03-06
suricata ET MALWARE Bifrose Response from Controller rev 5 2024-03-06
suricata ET EXPLOIT_KIT TDS Sutra - cookie set RULEZ rev 6 2024-03-06
suricata ET INFO RemoteControlX rctrlx service created rev 3 2024-03-06
suricata ET MALWARE Backdoor.Win32.Xyligan Checkin rev 4 2024-03-06
suricata ET WEB_SPECIFIC_APPS Kalptaru Infotech Automated Link Exchange Portal cat_id Parameter SQL Injection rev 8 2024-03-06
suricata ET WEB_SPECIFIC_APPS Dog Pedigree Online Database managePerson.php personId Parameter SQL Injection rev 8 2024-03-06
suricata ET INFO HTTP Request to a *.noc.su domain rev 5 2024-03-06
suricata ET EXPLOIT_KIT TDS Sutra - request in.cgi rev 4 2024-03-06
suricata ET WEB_SPECIFIC_APPS Possible Rentventory SQL Injection Attempt rev 10 2024-03-06
suricata ET INFO possible Xiaomi phone data leakage HTTP rev 5 2024-03-06
suricata ET EXPLOIT Apache Struts Possible OGNL AllowStaticMethodAccess in URI rev 5 2024-03-06
suricata ET MOBILE_MALWARE Android/FakeTimer.A Reporting to CnC rev 6 2024-03-06
suricata ET WEB_SPECIFIC_APPS Horde XSS attempt test.php rev 10 2024-03-06
suricata ET WEB_SPECIFIC_APPS Experts answer.php question_id parameter SQL Injection rev 8 2024-03-06
suricata ET MALWARE APT CozyCar SSL Cert 2 rev 4 2024-03-06
suricata ET SMTP Robtex.com Block Message rev 3 2024-03-06
suricata ET SCAN MYSQL 4.1 brute force root login attempt rev 5 2024-03-06
suricata ET SCAN MYSQL MySQL Remote FAST Account Password Cracking rev 6 2024-03-06
suricata ET EXPLOIT TP-LINK Known Malicious Router DNS Change GET Request rev 5 2024-03-06
suricata ET EXPLOIT_KIT Redirect to DotkaChef EK Landing rev 6 2024-03-06
suricata ET MALWARE EvilGrab/Vidgrab Checkin rev 4 2024-03-06
suricata ET MALWARE Cookies/Cookiebag Checkin rev 5 2024-03-06
suricata ET EXPLOIT Generic ADSL Router DNS Change GET Request rev 5 2024-03-06
suricata ET EXPLOIT Possible Qmail CVE-2014-6271 Mail From attempt rev 4 2024-03-06
suricata ET MALWARE Win32/Kelihos.F Checkin rev 4 2024-03-06
suricata ET HUNTING SUSPICIOUS *.doc.exe in HTTP URL rev 4 2024-03-06
suricata ET WEB_SPECIFIC_APPS WebPhotoPro galeri_info.php lang Parameter SQL Injection rev 7 2024-03-06
suricata ET INFO TLS possible TOR SSL traffic rev 5 2024-03-06
suricata ET WEB_SPECIFIC_APPS Joomla Full Path Disclosure -- content.php rev 9 2024-03-06
suricata ET MALWARE Backdoor.Win32.Svlk Client Checkin rev 2 2024-03-06
suricata ET WEB_SPECIFIC_APPS Scripts For Sites EZ e-store searchresults.php where Parameter SQL Injection rev 7 2024-03-06
suricata ET DOS Terse HTTP GET Likely LOIC rev 3 2024-03-06
suricata ET INFO MS Remote Desktop POS User Login Request rev 2 2024-03-06
suricata ET WEB_SPECIFIC_APPS DevelopItEasy Photo Gallery photo_id parameter SQL Injection rev 9 2024-03-06
suricata ET WEB_SPECIFIC_APPS RealtyListings detail.asp iPro Parameter SQL Injection rev 7 2024-03-06
suricata ET MALWARE Darkshell.A Checkin XOR C0 Win XP rev 3 2024-03-06
suricata ET EXPLOIT Zollard PHP Exploit Telnet Outbound rev 3 2024-03-06
suricata ET EXPLOIT ASUS RT N56U Router DNS Change GET Request 2 rev 5 2024-03-06
suricata ET WORM TheMoon.linksys.router 2 rev 6 2024-03-06