From 3d72248f3b7837a36e184288311bf0397cefc064 Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Thu, 9 Jul 2015 14:27:03 +0200
Subject: Add some drupal rules

---
 whitelist.yara | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/whitelist.yara b/whitelist.yara
index 3b3e361..58e237d 100644
--- a/whitelist.yara
+++ b/whitelist.yara
@@ -36,10 +36,20 @@ private rule Magento
         hash.sha1(0, filesize)  == "44ba7a5b685f4a52113559f366aaf6e9a22ae21e"  // app/code/core/Mage/Adminhtml/Model/Url.php
 }
 
+private rule Drupal
+{
+    condition:
+        hash.sha1(0, filesize)  == "23cc0e2c6eebe94fe189e258a3658b40b0005891" or // modules/simpletest/tests/upgrade/drupal-6.bare.database.php
+        hash.sha1(0, filesize)  == "8cb36d865b951378c3266dca7d5173a303e8dcff" or // modules/simpletest/tests/upgrade/drupal-6.filled.database.php
+        hash.sha1(0, filesize)  == "6c9c01bef14f8f64ef0af408f7ed764791531cc6" or // modules/system/system.module
+        hash.sha1(0, filesize)  == "ad03ed890400cf319f713ee0b4b6a62a5710f580" // modules/system/system.admin.inc
+}
+
 private rule IsWhitelisted
 {
     condition:
         Wordpress or
         Prestashop or
-        Magento
+        Magento or
+        Drupal
 }
-- 
cgit v1.3