php-malware-finder - Detect potentially malicious PHP files

Age	Commit message (Collapse)	Author
2016-02-23	Rename a rule	Julien (jvoisin) Voisin

2016-02-23	Add a wonderful testsuite!	Julien Voisin

2016-02-23	Add more simple signatures	Julien Voisin

2016-02-22	Fix #16	Julien Voisin
	Yeah, PMF needs a testsuite.
2016-02-22	Remove a rule that triggered too many FP	Julien Voisin
	It seems that a lot of php developers are using $__ as a legitimate variable name.
2016-02-17	Add some sql keywords (xp_*)	Julien Voisin

2016-02-15	typo fix in malwares.yara	Julien "shaddai" Reveret

2016-02-15	some rules cannot be used on a Debian squeeze distribution	Julien "shaddai" Reveret

2016-02-15	changelog modified for version 0.2.20.2.2	Julien "shaddai" Reveret

2016-02-15	Reduce FP triggered by the TooShort rule	shaddai
	The TooShort rule is now used against .ph files in order to reduce the number of false positives triggered by pictures and JS files. Using the wc command ionly once should reduce I/O load too.
2016-02-12	posix_* ++	Julien Voisin

2016-02-12	Add `php://` to the blacklist	Julien Voisin

2016-02-12	Strings are nocase	Julien Voisin

2016-02-12	chmod777	Julien Voisin

2016-02-12	Add a few artefacts taken from `assdick.php`, aka "fuhosin"	Julien Voisin

2016-02-12	Makes a rule more generic	Julien Voisin

2016-02-12	symfony added, new versions of wordpress and drupal	shaddai

2016-02-05	Update README.md	jvoisin

2016-02-05	handle filenames with spaces	Sebastien Blot

2016-02-03	Add yara version requirement in the README file	Julien Voisin

2016-02-03	Move the README file	Julien Voisin

2016-02-03	Merge branch 'master' of gitlab.nbs-system.com:packages/php-malware-finder	Julien Voisin

2016-02-03	Finalize merge	Julien Voisin

2016-02-03	Merge branch 'master' of github.com:nbs-system/php-malware-finder	Julien Voisin

2016-02-03	Add some bad_php rules	Julien Voisin

2016-02-01	0.2.1 : docroot-check.sh added	Julien "shaddai" Reveret

2016-02-01	docroot-checker records sha1sums to prevent rescanning the whole docroot ↵	Julien "shaddai" Reveret
	next time
2016-01-29	add docroot-check.sh : check php files inside Apache DocumentRoot	Julien "shaddai" Reveret

2016-01-29	hashes whitelist updated with wordpress 4.2.3 and 4.4.1 FP	Julien "shaddai" Reveret

2016-01-28	fix typo	Sebastien Blot

2016-01-28	update changelog	Sebastien Blot

2016-01-28	ignore errors in clean rule	Sebastien Blot

2016-01-12	new rules : ini_get, disable_magic_quotes and restore_bypass updated	shaddai
	these rules were added in order to detect new malware samples from https://github.com/nikicat/web-malware-collection
2016-01-12	new malware repository added	shaddai

2016-01-12	added register_globals to restore_bypass, new rules : ini_get and ↵	Julien "shaddai" Reveret
	disable_magic_quotes
2016-01-05	Update the documentation	jvoisin

2016-01-05	Refactor the `;eval(` rule	jvoisin

2016-01-05	Cleanup the wordlist	jvoisin

2016-01-04	Revert a broken/wip commit	jvoisin

2016-01-04	Add a rule to match multiplescomments	jvoisin

2016-01-04	Add some rules	jvoisin

2016-01-04	fix overwrite by previous commit	shaddai

2016-01-04	one_line_trick function	shaddai
	The newly added function allows to check for files containing oneliners webshells, these files are mostly composed of one or two very long lines
2016-01-04	Fix a stupid typo	jvoisin
	`eval(` patterns are now much better detected.
2016-01-04	Add `-t` to specify the number of threads to use	jvoisin

2016-01-04	Add a whitelist for wordpress 4.4	jvoisin

2016-01-04	Perf optimization and rules completion	jvoisin

2016-01-04	Simplify a bit some rules	jvoisin
	- Remove `b64_concat` since it was close to useless - Make `too_many_chr` non-greddy Those changes will make our malwares.yara rules yara-git friendly.
2015-12-11	cleaning rule updated	Julien "shaddai" Reveret

2015-12-03	files with no end of line or less than 3 lines and huge (more than 300) ↵	Julien "shaddai" Reveret
	amonts of characters are detected as suspicious