From ced28d12fecc276475ec5b98b117c4bd866c99fc Mon Sep 17 00:00:00 2001
From: Julien Voisin
Date: Fri, 12 Feb 2016 13:25:48 +0100
Subject: chmod777

---
 php-malware-finder/bad_php.yara | 1 +
 1 file changed, 1 insertion(+)

diff --git a/php-malware-finder/bad_php.yara b/php-malware-finder/bad_php.yara
index e3bdb76..1fb185f 100644
--- a/php-malware-finder/bad_php.yara
+++ b/php-malware-finder/bad_php.yara
@@ -33,6 +33,7 @@ rule Misc
     strings:
         $header_splitting = /header\s*\(.*\$_(GET|POST|REQUEST|COOKIE).*\)/
         $serialize = /unserialize\s*\(.*\)|unserialize_callback_func/
+        $chmod = /chmod\s*(.*777/
     condition:
         any of them
 }
-- 
cgit v1.3