Browse Rules

Search and filter across all detection sources

1,590 rules

signature-base unknown yara

webshell_asp_shell [yara]

Web Shell - file shell.asp
signature-base unknown yara

webshell_Ani_Shell [yara]

Web Shell - file Ani-Shell.php
signature-base unknown yara

webshell_Java_Shell [yara]

Web Shell - file Java Shell.jsp
signature-base unknown yara

webshell_Sst_Sheller [yara]

Web Shell - file Sst-Sheller.php
signature-base unknown yara

webshell_WinX_Shell [yara]

Web Shell - file WinX Shell.php
yara unknown yara

webshell_Ani_Shell [webshells]

Web Shell - file Ani-Shell.php
yara unknown yara

webshell_asp_shell [webshells]

Web Shell - file shell.asp
yara unknown yara

webshell_Java_Shell [webshells]

Web Shell - file Java Shell.jsp
yara unknown yara

webshell_Sst_Sheller [webshells]

Web Shell - file Sst-Sheller.php
yara unknown yara

webshell_WinX_Shell [webshells]

Web Shell - file WinX Shell.php
signature-base unknown yara

webshell_PHP_Shell_x3 [yara]

Web Shell - file PHP Shell.php
yara unknown yara

webshell_PHP_Shell_x3 [webshells]

Web Shell - file PHP Shell.php
yara unknown yara

webshell_Worse_Linux_Shell [webshells]

Web Shell - file Worse Linux Shell.php
hayabusa high sigma

PowerShell ShellCode

Detects Base64 encoded Shellcode
sigma high sigma

PowerShell ShellCode

Detects Base64 encoded Shellcode
signature-base unknown yara

webshell_Worse_Linux_Shell_1 [yara]

Web Shell - file Worse Linux Shell.php
signature-base unknown yara

webshell_Antichat_Shell_v1_3_2 [yara]

Web Shell - file Antichat Shell v1.3.php
signature-base unknown yara

webshell_r57shell_r57shell127_SnIpEr_SA_Shell_EgY_SpIdEr_ShElL_V2_r57_xxx [yara]

Web Shell
yara unknown yara

webshell_Antichat_Shell_v1_3_2 [webshells]

Web Shell - file Antichat Shell v1.3.php
sigma medium sigma

Linux Shell Pipe to Shell

Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell
sagan informational other

[HUAWEI] SHELL - CMD

[HUAWEI] SHELL - CMD
sigma high sigma

Shellshock Expression

Detects shellshock expressions in log files
wazuh low xml

The shell stopped unexpectedly

The shell stopped unexpectedly
hayabusa medium sigma

Potential ShellDispatch.DLL Functionality Abuse

Detects potential "ShellDispatch.dll" functionality abuse to execute arbitrary binaries via "ShellExecute"
sigma medium sigma

Potential ShellDispatch.DLL Functionality Abuse

Detects potential "ShellDispatch.dll" functionality abuse to execute arbitrary binaries via "ShellExecute"