Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	WebShell_php_webshells_pHpINJ	—	—
yara	WebShell_php_webshells_NGH	—	—
yara	WebShell__Small_Web_Shell_by_ZaCo_small_zaco_zacosmall	—	—
yara	WebShell_Generic_PHP_8	—	—
yara	WebShell__PH_Vayv_PHVayv_PH_Vayv_klasvayv_asp_php	—	—
yara	WebShell_Generic_PHP_9	—	—
yara	WebShell__PH_Vayv_PHVayv_PH_Vayv	—	—
yara	thelast_orice2	—	—
yara	WebShell_Generic_PHP_1	—	—
yara	WebShell_Generic_PHP_2	—	—
yara	WebShell__CrystalShell_v_1_erne_stres	—	—
yara	WebShell_Generic_PHP_3	—	—
yara	WebShell_Generic_PHP_4	—	—
yara	WebShell_GFS	—	—
yara	WebShell__CrystalShell_v_1_sosyete_stres	—	—
yara	WebShell_Generic_PHP_10	—	—
yara	WebShell_Generic_PHP_11	—	—
yara	WebShell__findsock_php_findsock_shell_php_reverse_shell	—	—
yara	FSO_s_sincap	—	—
yara	WebShell_Generic_PHP_6	—	—
yara	Unpack_Injectt	—	—
yara	HYTop_DevPack_fso	—	—
yara	FeliksPack3___PHP_Shells_ssh	—	—
yara	Debug_BDoor	—	—
yara	bin_Client	—	—
yara	ZXshell2_0_rar_Folder_ZXshell	—	—
yara	RkNTLoad	—	—
yara	hkshell_hkshell	—	—
yara	iMHaPFtp	—	—
yara	Unpack_TBack	—	—
yara	DarkSpy105	—	—
yara	EditServer_Webshell	—	—
yara	FSO_s_reader	—	—
yara	ASP_CmdAsp	—	—
yara	KA_uShell	—	—
yara	PHP_Backdoor_v1	—	—
yara	svchostdll	—	—
yara	HYTop_DevPack_server	—	—
yara	vanquish	—	—
yara	winshell	—	—