Add a simple rule

1 files changed, 2 insertions, 1 deletions

diff --git a/data/php.yar b/data/php.yar
index 4470e1b..1b120fc 100644
--- a/data/php.yar
+++ b/data/php.yar
@@ -100,6 +100,7 @@ rule DodgyPhp
         $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
         $at_eval = /@eval\s*\(/ nocase
         $double_var = /\${\s*\${/
+        $username = /getenv(['"]username["'])/
         $extract = /extract\s*\(\s*\$_(GET|POST|REQUEST|COOKIE|SERVER)/
         $reversed = /noitcnuf_etaerc|metsys|urhtssap|edulcni|etucexe_llehs/ nocase
                                 $silenced_include =/@\s*include\s*/ nocase
@@ -322,7 +323,7 @@ rule DodgyStrings
         $ = "slowloris" fullword nocase
         $ = "suhosin" fullword
         $ = "sun-tzu" fullword nocase // Because quotes from the Art of War is mandatory for any cool webshell.
-    $ = /trojan (payload)?/
+        $ = /trojan (payload)?/
         $ = "uname -a" fullword
         $ = "visbot" nocase fullword
         $ = "warez" fullword nocase