Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
yara webshell_iMHaPFtp_2 — —
yara webshell_Jspspyweb — —
yara webshell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2 — —
yara webshell_SimAttacker_Vrsion_1_0_0_priv8_4_My_friend — —
yara webshell_phpshell_2_1_pwhash — —
yara webshell_PHPRemoteView — —
yara webshell_jsp_12302 — —
yara webshell_caidao_shell_guo — —
yara webshell_remview_fix — —
yara webshell_asp_cmd — —
yara webshell_php_sh_server — —
yara webshell_PH_Vayv_PH_Vayv — —
yara webshell_caidao_shell_ice — —
yara webshell_cihshell_fix — —
yara webshell_asp_shell — —
yara webshell_Private_i3lue — —
yara webshell_php_up — —
yara webshell_Mysql_interface_v1_0 — —
yara webshell_php_s_u — —
yara webshell_phpshell_2_1_config — —
yara webshell_asp_EFSO_2 — —
yara webshell_jsp_up — —
yara webshell_NetworkFileManagerPHP — —
yara webshell_Server_Variables — —
yara webshell_caidao_shell_ice_2 — —
yara webshell_caidao_shell_mdb — —
yara webshell_DarkBlade1_3_asp_indexx — —
yara webshell_phpshell3 — —
yara webshell_jsp_hsxa — —
yara webshell_jsp_utils — —
yara webshell_asp_01 — —
yara webshell_asp_404 — —
yara webshell_webshell_cnseay02_1 — —
yara webshell_php_fbi — —
yara webshell_B374kPHP_B374k — —
yara webshell_php_dodo_zip — —
yara webshell_aZRaiLPhp_v1_0 — —
yara webshell_php_list — —
yara webshell_ironshell — —
yara webshell_caidao_shell_404 — —