From 40dbc1cb5bd274452ac56613b61976fe218ce031 Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Thu, 9 Jul 2015 14:42:32 +0200
Subject: Simplify the php rule

---
 malwares.yara | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/malwares.yara b/malwares.yara
index 9e962f0..1707a0a 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -20,11 +20,10 @@ include "whitelist.yara"
 global private rule IsPhp
 {
     strings:
-        $php = "<?"
-        $xml = "<?xml"
+        $php = /<\?[^x]/
 
     condition:
-        $php and not $xml and filesize < 5MB
+        $php and filesize < 5MB
 }
 
 private rule IRC
-- 
cgit v1.3