summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJulien Voisin2016-02-22 11:55:31 +0100
committerJulien Voisin2016-02-22 11:55:31 +0100
commit1cd54c4f41ccea0c48b3c79d1edc9024fd2f011e (patch)
treec6c2a7e1d69ac10d472b06fc90f3f7f59fbdcbac
parentff2443d4ee9a94163898dce91ff575cd77407991 (diff)
Remove a rule that triggered too many FP
It seems that a lot of php developers are using $__ as a legitimate variable name.
-rw-r--r--php-malware-finder/malwares.yara1
1 files changed, 0 insertions, 1 deletions
diff --git a/php-malware-finder/malwares.yara b/php-malware-finder/malwares.yara
index 1a4b940..1fa5c22 100644
--- a/php-malware-finder/malwares.yara
+++ b/php-malware-finder/malwares.yara
@@ -119,7 +119,6 @@ rule DodgyPhp
119 $udp_dos = /sockopen\s*\(['"]udp:\/\// 119 $udp_dos = /sockopen\s*\(['"]udp:\/\//
120 $user_function = /(call_user_func|create_function)/ 120 $user_function = /(call_user_func|create_function)/
121 $various = "<!--#exec cmd=" //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec 121 $various = "<!--#exec cmd=" //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
122 $vars = /\$__+/ // $__ is rarely used in legitimate scripts
123 122
124 condition: 123 condition:
125 (any of them or CloudFlareBypass) and not IsWhitelisted 124 (any of them or CloudFlareBypass) and not IsWhitelisted