Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
yara webshell_Dx_Dx — —
yara webshell_asp_ntdaddy — —
yara webshell_MySQL_Web_Interface_Version_0_8 — —
yara webshell_elmaliseker_2 — —
yara webshell_ASP_RemExp — —
yara webshell_jsp_list1 — —
yara webshell_phpkit_1_0_odd — —
yara webshell_jsp_123 — —
yara webshell_asp_1 — —
yara webshell_ASP_tool — —
yara webshell_cmd_win32 — —
yara webshell_jsp_jshell — —
yara webshell_ASP_zehir4 — —
yara webshell_wsb_idc — —
yara webshell_cpg_143_incl_xpl — —
yara webshell_mumaasp_com — —
yara webshell_php_404 — —
yara webshell_webshell_cnseay_x — —
yara webshell_asp_up — —
yara webshell_phpkit_0_1a_odd — —
yara webshell_ASP_cmd — —
yara webshell_PHP_Shell_x3 — —
yara webshell_PHP_g00nv13 — —
yara webshell_php_h6ss — —
yara webshell_jsp_zx — —
yara webshell_Ani_Shell — —
yara webshell_jsp_k8cmd — —
yara webshell_jsp_k81 — —
yara webshell_ASP_zehir — —
yara webshell_Worse_Linux_Shell — —
yara webshell_zacosmall — —
yara webshell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit — —
yara webshell_redirect — —
yara webshell_jsp_cmdjsp — —
yara webshell_Java_Shell — —
yara webshell_asp_1d — —
yara webshell_jsp_IXRbE — —
yara webshell_PHP_G5 — —
yara webshell_PHP_r57142 — —
yara webshell_jsp_tree — —