Simplify the php rule

1 files changed, 2 insertions, 3 deletions

diff --git a/malwares.yara b/malwares.yara
index 9e962f0..1707a0a 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -20,11 +20,10 @@ include "whitelist.yara"
 global private rule IsPhp
 {
     strings:
-        $php = "<?"
-        $xml = "<?xml"
+        $php = /<\?[^x]/
 
     condition:
-        $php and not $xml and filesize < 5MB
+        $php and filesize < 5MB
 }
 
 private rule IRC