Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
yara EditServer_Webshell — —
yara FSO_s_reader — —
yara ASP_CmdAsp — —
yara KA_uShell — —
yara PHP_Backdoor_v1 — —
yara svchostdll — —
yara HYTop_DevPack_server — —
yara vanquish — —
yara winshell — —
yara FSO_s_remview — —
yara saphpshell — —
yara HYTop2006_rar_Folder_2006Z — —
yara admin_ad — —
yara FSO_s_casus15 — —
yara BIN_Client — —
yara shelltools_g0t_root_uptime — —
yara Simple_PHP_BackDooR — —
yara sig_2005Gray — —
yara DllInjection — —
yara Mithril_v1_45_Mithril — —
yara hkshell_hkrmv — —
yara FeliksPack3___PHP_Shells_r57 — —
yara phpshell — —
yara FSO_s_cmd — —
yara FeliksPack3___PHP_Shells_phpft — —
yara FSO_s_indexer — —
yara r57shell — —
yara bdcli100 — —
yara HYTop_DevPack_2005Red — —
yara HYTop2006_rar_Folder_2006X2 — —
yara xssshell_db — —
yara rdrbs084 — —
yara HYTop_CaseSwitch_2005 — —
yara eBayId_index3 — —
yara FSO_s_phvayv — —
yara byshell063_ntboot — —
yara FSO_s_casus15_2 — —
yara installer — —
yara uploader — —
yara FSO_s_remview_2 — —