Type
Rule Name
Description
Date
Reference
Ref
VT
Info
YARA
WEBSHELL_CSS_PassThrough_Sep26
Detects suspicious CSS files that contain pass-through and cookie decoding functionality, which is often used in webshells
2026-09-28
https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation
YARA
Operation_Emil_Webshell_pluginsphp
Detects an Operation Emil Webshell - file plugins.php
2016-07-29
Operation Emil
Scan your endpoints, forensic images or collected files with our portable scanner THOR