Merge pull request #361 from wesinator/patch-1

fix blackhole php regex

Merge pull request #361 from wesinator/patch-1
fix blackhole php regex
396f1f86 · Jaume Martin · GitHub · 84fcc938 · 842dd653 · 396f1f86
Unverified Commit 396f1f86 authored Jun 22, 2020 by Jaume Martin Committed by GitHub Jun 22, 2020
Hide whitespace changes
Inline Side-by-side

Showing with 1 additions and 1 deletions

EK_Blackhole.yar exploit_kits/EK_Blackhole.yar +1 -1

No files found.
--- a/exploit_kits/EK_Blackhole.yar
+++ b/exploit_kits/EK_Blackhole.yar
@@ -116,7 +116,7 @@ condition:
 rule blackhole_basic :  EK
 {
    strings:
-        $a = /\.php\?\.*\?\:[a-zA-Z0-9\:]{6,}\&\.*\?\&/
+        $a = /\.php\?.*?\:[a-zA-Z0-9\:]{6,}?\&.*?\&/
    condition:
        $a
 }