From 6cf51485a3a10d00092fe0718efe5415d0788913 Mon Sep 17 00:00:00 2001 From: Julien "shaddai" Reveret Date: Fri, 29 Jul 2016 10:22:21 +0200 Subject: adding custom.yar for user own webapp(s) --- php-malware-finder/whitelist.yar | 1 + php-malware-finder/whitelists/custom.yar | 15 +++++++++++++++ 2 files changed, 16 insertions(+) create mode 100644 php-malware-finder/whitelists/custom.yar diff --git a/php-malware-finder/whitelist.yar b/php-malware-finder/whitelist.yar index 2d1ea10..b957660 100644 --- a/php-malware-finder/whitelist.yar +++ b/php-malware-finder/whitelist.yar @@ -10,6 +10,7 @@ include "whitelists/symfony.yar" include "whitelists/phpmyadmin.yar" include "whitelists/magento2.yar" include "whitelists/prestashop.yar" +include "whitelists/custom.yar" private rule Magento : ECommerce diff --git a/php-malware-finder/whitelists/custom.yar b/php-malware-finder/whitelists/custom.yar new file mode 100644 index 0000000..5f1dedb --- /dev/null +++ b/php-malware-finder/whitelists/custom.yar @@ -0,0 +1,15 @@ +/* Add your own rules here */ +import "hash" + +/* remove me if you add rules +private rule Custom : Blog +{ + meta: + generated = "2016-07-28T09:50:53.795037" + + condition: + /* my own webapp 0.42 */ + hash.sha1(0, filesize) == "deadbeaf" +} + +remove me if you add rules */ -- cgit v1.3