From aca14bfc3b2fa40a470a4f0fd8dcc1e0856f9c1c Mon Sep 17 00:00:00 2001
From: Julien Voisin
Date: Tue, 28 Feb 2023 15:30:46 +0100
Subject: Add a simple rule

---
 data/php.yar | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'data/php.yar')

diff --git a/data/php.yar b/data/php.yar
index 4470e1b..1b120fc 100644
--- a/data/php.yar
+++ b/data/php.yar
@@ -100,6 +100,7 @@ rule DodgyPhp
         $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
         $at_eval = /@eval\s*\(/ nocase
         $double_var = /\${\s*\${/
+	$username = /getenv(['"]username["'])/
         $extract = /extract\s*\(\s*\$_(GET|POST|REQUEST|COOKIE|SERVER)/
         $reversed = /noitcnuf_etaerc|metsys|urhtssap|edulcni|etucexe_llehs/ nocase
 				$silenced_include =/@\s*include\s*/ nocase
@@ -322,7 +323,7 @@ rule DodgyStrings
         $ = "slowloris" fullword nocase
         $ = "suhosin" fullword
         $ = "sun-tzu" fullword nocase // Because quotes from the Art of War is mandatory for any cool webshell.
-    $ = /trojan (payload)?/
+        $ = /trojan (payload)?/
         $ = "uname -a" fullword
         $ = "visbot" nocase fullword
         $ = "warez" fullword nocase
-- 
cgit v1.3