Add some rules

1 files changed, 3 insertions, 0 deletions

diff --git a/malwares.yara b/malwares.yara
index de735a7..7167708 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -117,6 +117,7 @@ rule DodgyPhp
         $udp_dos = /sockopen\s*\(['"]udp:\/\//
         $iniset_urlinclude = /ini_set\('allow_url_include,\ * 1'\)/
         $iis_com = /IIS:\/\/localhost\/w3svc/
+        $user_function = /(call_user_func|create_function)/
 
     condition:
         (any of them or CloudFlareBypass) and not IsWhitelisted
@@ -174,6 +175,8 @@ rule DodgyStrings
         $ = "/etc/resolv.conf"
         $ = "/etc/syslog.conf"
         $ = "/etc/proftpd.conf"
+        $ = "/windows/system32/"
+        $ = "WScript.Shell"
         $ = "WinExec"
         $ = "uname -a" fullword
         $ = "nc -l" fullword