Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
yara webshell_caidao_shell_hkmjj — —
yara webshell_PHP_bug_1_ — —
yara webshell_ELMALISEKER_Backd00r — —
yara webshell_minupload — —
yara webshell_jsp_jdbc — —
yara webshell_php_moon — —
yara webshell_c99_madnet_smowu — —
yara webshell_asp_Rader — —
yara webshell_Inderxer — —
yara webshell_jsp_action — —
yara webshell_spjspshell — —
yara webshell_asp_cmdasp — —
yara webshell_php_2 — —
yara webshell_asp_dabao — —
yara webshell_php_backdoor — —
yara webshell_PHP_b37 — —
yara webshell_PHP_c37 — —
yara webshell_jsp_cmdjsp_2 — —
yara webshell_PHP_co — —
yara webshell_asp_list — —
yara webshell_php_cmd — —
yara webshell_asp_ajn — —
yara webshell_jsp_hsxa1 — —
yara webshell_r57_1_4_0 — —
yara webshell_Crystal_Crystal — —
yara webshell_WinX_Shell — —
yara webshell_php_ghost — —
yara webshell_PHP_150 — —
yara webshell_jsp_guige02 — —
yara webshell_jsp_sys3 — —
yara webshell_s72_Shell_v1_1_Coding — —
yara webshell_customize — —
yara webshell_PHPJackal_v1_5 — —
yara webshell_jsp_list — —
yara webshell_Sst_Sheller — —
yara webshell_Safe_mode_breaker — —
yara webshell_Antichat_Shell_v1_3_2 — —
yara webshell_Macker_s_Private_PHPShell — —
yara webshell_PHP_404 — —
yara webshell_simple_backdoor — —