From a57878b13cb5b202b14dc36c4bde0b1cb2deead0 Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Sat, 16 Jul 2016 18:36:29 +0200
Subject: IRC keywords aren't case-sensitive

---
 php-malware-finder/common.yar | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/php-malware-finder/common.yar b/php-malware-finder/common.yar
index d3ed3c2..ae2b784 100644
--- a/php-malware-finder/common.yar
+++ b/php-malware-finder/common.yar
@@ -12,14 +12,14 @@ rule CloudFlareBypass
 private rule IRC
 {
     strings:
-        $ = "USER" fullword
-        $ = "PASS" fullword
-        $ = "PRIVMSG" fullword
-        $ = "MODE" fullword
-        $ = "PING" fullword
-        $ = "PONG" fullword
-        $ = "JOIN" fullword
-        $ = "PART" fullword
+        $ = "USER" fullword nocase
+        $ = "PASS" fullword nocase
+        $ = "PRIVMSG" fullword nocase
+        $ = "MODE" fullword nocase
+        $ = "PING" fullword nocase
+        $ = "PONG" fullword nocase
+        $ = "JOIN" fullword nocase
+        $ = "PART" fullword nocase
 
     condition:
         5 of them
-- 
cgit v1.3