1 files changed, 2 insertions, 0 deletions

diff --git a/malwares.yara b/malwares.yara
index dc1a6cd..c5a11e6 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -143,6 +143,8 @@ rule DangerousPhp
         $u = "fpassthru" fullword
         $v = "posix_setuid" fullword
         $w = "xmlrpc_decode" fullword
+        $x = "show_source" fullword
+        $y = "pcntl_exec" fullword
 
         $whitelist = /escapeshellcmd|escapeshellarg/