Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
yara h4ntu_shell__powered_by_tsoi_ — —
yara webshell_000_403_807_a_c5_config_css_dm_he1p_xxx — —
yara webshell_NIX_REMOTE_WEB_SHELL_nstview_xxx — —
yara Ajan_asp — —
yara webshell_r57shell127_r57_iFX_r57_kartal_r57_antichat — —
yara webshell_c99_c99shell_c99_c99shell — —
yara MySQL_Web_Interface_Version_0_8_php — —
yara webshell_000_403_c5_config_myxx_queryDong_spyjsp2010_zend — —
yara webshell_he1p_JspSpy_nogfw_ok_style_1_JspSpy1 — —
yara webshell_r57shell127_r57_kartal_r57 — —
yara webshell_asp_404 — —
yara simple_cmd_html — —
yara multiple_webshells_0001 — —
yara multiple_webshells_0002 — —
yara multiple_webshells_0003 — —
yara webshell_c99_c66_c99_shadows_mod_c99shell — —
yara multiple_webshells_0004 — —
yara multiple_webshells_0005 — —
yara webshell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz — —
yara multiple_webshells_0006 — —
yara webshell_c99_c99shell_c99_w4cking_Shell_xxx — —
yara multiple_webshells_0007 — —
yara multiple_webshells_0008 — —
yara multiple_webshells_0009 — —
yara WebShell_php_webshells_matamu — —
yara webshell_NIX_REMOTE_WEB_SHELL_NIX_REMOTE_WEB_xxx1 — —
yara webshell_webshell_cnseay02_1 — —
yara WebShell_ru24_post_sh — —
yara WebShell_hiddens_shell_v1 — —
yara WebShell_c99_madnet — —
yara webshell_Shell_ci_Biz_was_here_c100_v_xxx — —
yara WebShell_c99_locus7s — —
yara webshell_itsec_PHPJackal_itsecteam_shell_jHn — —
yara WebShell_JspWebshell_1_2 — —
yara webshell_gfs_sh_r57shell_r57shell127_SnIpEr_SA_xxx — —
yara WebShell_safe0ver — —
yara webshell_shell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz — —
yara webshell_2_520_job_JspWebshell_1_2_ma1_ma4_2 — —
yara WebShell_php_webshells_kral — —
yara WebShell_cgitelnet — —