Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET WEB_SERVER Onmouseover= in URI - Likely Cross Site Scripting Attempt rev 9 2024-03-06
suricata ET MALWARE Georbot checkin rev 5 2024-03-06
suricata ET EXPLOIT Possible ShuttleTech 915WM DNS Change Attempt rev 5 2024-03-06
suricata ET WEB_SPECIFIC_APPS YourFreeWorld Autoresponder hosting tr.php id Parameter SQL Injection rev 7 2024-03-06
suricata ET EXPLOIT_KIT Bleeding Life 2 GPLed Exploit Pack payload download rev 6 2024-03-06
suricata ET WEB_SPECIFIC_APPS MyioSoft EasyBookMarker Parent parameter SQL Injection rev 9 2024-03-06
suricata ET MALWARE VBS/Wimmie.A Set rev 10 2024-03-06
suricata ET INFO HTTP Request to a *.xe.cx domain rev 6 2024-03-06
suricata ET ADWARE_PUP OptimizerPro Checkin rev 6 2024-03-06
suricata ET MALWARE ftpchk3.php upload attempted rev 6 2024-03-06
suricata ET INFO HTTP Request to a *.noc.su domain rev 5 2024-03-06
suricata ET INFO HTTP Request to a *.de.ms domain rev 6 2024-03-06
suricata ET WEB_SPECIFIC_APPS Easyedit CMS news.php intPageID parameter sql injection rev 8 2024-03-06
suricata ET INFO Unsupported/Fake Windows NT Version 5.0 rev 6 2024-03-06
suricata ET ACTIVEX SaschArt SasCam Webcam Server ActiveX Control Head Method Buffer Overflow Attempt rev 3 2024-03-06
suricata ET MALWARE Bitter APT Activity - Secondary Payload Retrieval Attempt rev 1 2024-03-06
suricata ET ADWARE_PUP Win32/DomaIQ Checkin rev 6 2024-03-06
suricata ET WEB_SPECIFIC_APPS RSS Simple News news.php pid parameter Remote SQL Injection rev 8 2024-03-06
suricata ET WEB_SPECIFIC_APPS SFS EZ Hotscripts-like Site showcategory.php cid Parameter SQL Injection rev 7 2024-03-06
suricata ET INFO Unsupported/Fake FireFox Version 2. rev 6 2024-03-06
suricata ET INFO Unsupported/Fake Internet Explorer Version MSIE 2. rev 7 2024-03-06
suricata ET WEB_SPECIFIC_APPS Synactis All_IN_THE_BOX ActiveX SaveDoc Method Arbitrary File Overwrite rev 4 2024-03-06
suricata ET EXPLOIT ASUS RT N56U Router DNS Change GET Request 3 rev 5 2024-03-06
suricata ET MALWARE Backdoor.Win32.Xtrat Checkin 2 rev 6 2024-03-06
suricata ET MALWARE ELF/muBoT IRC Activity 1 rev 3 2024-03-06
suricata ET SMTP Sorbs.net Block Message rev 3 2024-03-06
suricata ET WEB_SPECIFIC_APPS Joomla Full Path Disclosure -- ldap.php rev 9 2024-03-06
suricata ET MALWARE Linux.Mumblehard Spam Command CnC rev 2 2024-03-06
suricata ET WEB_SPECIFIC_APPS programsrating rate.php id XSS attempt rev 7 2024-03-06
suricata ET INFO EXE - Served Attached HTTP rev 9 2024-03-06
suricata ET MOBILE_MALWARE Android BatteryBotPro Checkin 2 rev 6 2024-03-06
suricata ET WEB_SPECIFIC_APPS My PHP Dating id parameter SQL Injection rev 10 2024-03-06
suricata ET INFO InstallIQ Updater Software request rev 5 2024-03-06
suricata ET MALWARE TROJ_PROX.AFV POST rev 12 2024-03-06
suricata ET MALWARE DDoS.XOR Checkin rev 4 2024-03-06
suricata ET WEB_SPECIFIC_APPS YourFreeWorld Classifieds Blaster tr.php id Parameter SQL Injection rev 7 2024-03-06
suricata ET WEB_SPECIFIC_APPS Lito Lite CMS cate.php cid parameter Remote SQL Injection rev 9 2024-03-06
suricata ET MALWARE Win32.Vilsel Checkin rev 4 2024-03-06
suricata ET SNMP Attempted TCP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String cable-docsis rev 3 2024-03-06
suricata ET WEB_SPECIFIC_APPS All In One Control Panel poll_id parameter SQL Injection rev 8 2024-03-06