Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	settings	—	—
yara	asp_proxy	—	—
yara	php_shell	—	—
yara	php_reverse_shell	—	—
yara	php_dns	—	—
yara	WEB_INF_web	—	—
yara	jsp_cmd	—	—
yara	laudanum	—	—
yara	php_file	—	—
yara	webshell_PHP_redcod	—	—
yara	warfiles_cmd	—	—
yara	asp_dns	—	—
yara	php_reverse_shell_2	—	—
yara	Laudanum_Tools_Generic	—	—
yara	Backdoor_WebShell_asp	—	—
yara	webshell_ChinaChopper_aspx	—	—
yara	webshell_ChinaChopper_php	—	—
yara	Dotico_PHP_webshell	—	—
yara	php_anuna	—	—
yara	php_in_image	—	—
yara	Weevely_Webshell	—	—
yara	webshell_h4ntu_shell_powered_by_tsoi_	—	—
yara	webshell_PHP_sql	—	—
yara	webshell_PHP_a	—	—
yara	webshell_iMHaPFtp_2	—	—
yara	webshell_Jspspyweb	—	—
yara	webshell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2	—	—
yara	webshell_SimAttacker_Vrsion_1_0_0_priv8_4_My_friend	—	—
yara	webshell_phpshell_2_1_pwhash	—	—
yara	webshell_PHPRemoteView	—	—
yara	webshell_jsp_12302	—	—
yara	webshell_caidao_shell_guo	—	—
yara	webshell_2_520_icesword_job_ma1_ma4_2	—	—
yara	webshell_phpspy_2005_full_phpspy_2005_lite_PHPSPY	—	—
yara	webshell_shell_phpspy_2006_arabicspy_hkrkoz	—	—
yara	webshell_c99_Shell_ci_Biz_was_here_c100_v_xxx	—	—
yara	webshell_2008_2009lite_2009mssql	—	—
yara	webshell_shell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_arabicspy_PHPSPY_hkrkoz	—	—
yara	webshell_807_dm_JspSpyJDK5_m_cofigrue	—	—
yara	webshell_Dive_Shell_1_0_Emperor_Hacking_Team_xxx	—	—