Detect backdoor-looking authentication schemes

1 files changed, 9 insertions, 0 deletions

diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar
index 50dcf98..527615e 100644
--- a/php-malware-finder/php.yar
+++ b/php-malware-finder/php.yar
@@ -44,6 +44,15 @@ rule CloudFlareBypass
         2 of them // Better be safe than sorry
 }
 
+rule PasswordProtection
+{
+    strings:
+        $md5 = /md5\s*\(\s*\$_(GET|REQUEST|POST|COOKIE)[^)]+\)\s*===?\s*['"][0-9a-f]{32}['"]/ nocase
+        $sha1 = /sha1\s*\(\s*\$_(GET|REQUEST|POST|COOKIE)[^)]+\)\s*===?\s*['"][0-9a-f]{32}['"]/ nocase
+    condition:
+        any of them
+}
+
 rule ObfuscatedPhp
 {
     strings: