Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
yara backupsql_php_often_with_c99shell — —
yara uploader_php_php — —
yara telnet_pl — —
yara w3d_php_php — —
yara WebShell_cgi — —
yara WinX_Shell_html — —
yara Dx_php_php — —
yara csh_php_php — —
yara pHpINJ_php_php — —
yara sig_2008_php_php — —
yara ak74shell_php_php — —
yara Rem_View_php_php — —
yara Java_Shell_js — —
yara STNC_php_php — —
yara aZRaiLPhp_v1_0_php — —
yara Moroccan_Spamers_Ma_EditioN_By_GhOsT_php — —
yara zacosmall_php — —
yara CmdAsp_asp — —
yara simple_backdoor_php — —
yara mysql_shell_php — —
yara Dive_Shell_1_0___Emperor_Hacking_Team_php — —
yara rootshell_php — —
yara Asmodeus_v0_1_pl — —
yara backup_php_often_with_c99shell — —
yara Reader_asp — —
yara phpshell17_php — —
yara myshell_php_php — —
yara SimShell_1_0___Simorgh_Security_MGZ_php — —
yara jspshall_jsp — —
yara webshell_php — —
yara connectback2_pl — —
yara DefaceKeeper_0_2_php — —
yara shells_PHP_wso — —
yara backdoor1_php — —
yara elmaliseker_asp — —
yara indexer_asp — —
yara Worse_Linux_Shell_php — —
yara s72_Shell_v1_1_Coding_html — —
yara hidshell_php_php — —
yara kacak_asp — —