Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
yara webshell_asp_cmdasp — —
yara webshell_spjspshell — —
yara webshell_jsp_action — —
yara webshell_Inderxer — —
yara webshell_asp_Rader — —
yara webshell_c99_madnet_smowu — —
yara webshell_php_moon — —
yara webshell_jsp_jdbc — —
yara webshell_minupload — —
yara webshell_ELMALISEKER_Backd00r — —
yara webshell_PHP_bug_1_ — —
yara webshell_caidao_shell_hkmjj — —
yara webshell_jsp_asd — —
yara webshell_jsp_inback3 — —
yara webshell_metaslsoft — —
yara webshell_asp_Ajan — —
yara webshell_config_myxx_zend — —
yara webshell_browser_201_3_ma_download — —
yara webshell_itsec_itsecteam_shell_jHn — —
yara webshell_ghost_source_icesword_silic — —
yara webshell_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_spy2009_m_ma3_xxx — —
yara webshell_2_520_job_ma1_ma4_2 — —
yara webshell_000_403_807_a_c5_config_css_dm_he1p_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_xxx — —
yara webshell_wso2_5_1_wso2_5_wso2 — —
yara webshell_000_403_c5_queryDong_spyjsp2010_t00ls — —
yara webshell_404_data_suiyue — —
yara webshell_in_JFolder_jfolder01_jsp_leo_warn — —
yara webshell_r57shell_r57shell127_SnIpEr_SA_Shell_EgY_SpIdEr_ShElL_V2_r57_xxx — —
yara webshell_807_a_css_dm_he1p_JspSpy_xxx — —
yara webshell_201_3_ma_download — —
yara webshell_browser_201_3_400_in_JFolder_jfolder01_jsp_leo_ma_warn_webshell_nc_download — —
yara webshell_shell_phpspy_2006_arabicspy — —
yara webshell_webshells_new_con2 — —
yara webshell_2_520_icesword_job_ma1_ma4_2 — —
yara webshell_phpspy_2005_full_phpspy_2005_lite_PHPSPY — —
yara webshell_shell_phpspy_2006_arabicspy_hkrkoz — —
yara webshell_c99_Shell_ci_Biz_was_here_c100_v_xxx — —
yara webshell_2008_2009lite_2009mssql — —
yara webshell_shell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_arabicspy_PHPSPY_hkrkoz — —
yara webshell_807_dm_JspSpyJDK5_m_cofigrue — —