Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
yara sig_2008_php_php — —
yara pHpINJ_php_php — —
yara csh_php_php — —
yara Dx_php_php — —
yara WinX_Shell_html — —
yara WebShell_cgi — —
yara w3d_php_php — —
yara FSO_s_indexer — —
yara telnet_pl — —
yara uploader_php_php — —
yara backupsql_php_often_with_c99shell — —
yara c99madshell_v2_0_php_php — —
yara lurm_safemod_on_cgi — —
yara r57shell — —
yara bdcli100 — —
yara HYTop_DevPack_config — —
yara CheshireCat_Gen1 — —
yara wh_bindshell_py — —
yara rst_sql_php_php — —
yara HYTop_DevPack_2005Red — —
yara HYTop2006_rar_Folder_2006X2 — —
yara r57shell_php_php — —
yara xssshell_db — —
yara klasvayv_asp — —
yara phvayvv_php_php — —
yara RemExp_asp — —
yara SimAttacker___Vrsion_1_0_0___priv8_4_My_friend_php — —
yara phpspy_2005_full — —
yara FSO_s_zehir4_2 — —
yara NT_Addy_asp — —
yara Tool_asp — —
yara jsp_reverse_jsp — —
yara ngh_php_php — —
yara fuckphpshell_php — —
yara shellbot_pl — —
yara small_php_php — —
yara Casus15_php_php — —
yara PhpShell — —
yara httpdoor — —
yara shankar_php_php — —