Commit aedf7598 by mmorenog Committed by GitHub

Update Blackhole_EK.yar

parent a5de3d3e
......@@ -116,7 +116,7 @@ condition:
rule blackhole_basic : exploit_kit
{
strings:
$a = /\.php\?.*?\:[a-zA-Z0-9\:]{6,}\&.*?\&/
$a = /\.php\?\.*?\:[a-zA-Z0-9\:]{6,}\&\.*?\&/
condition:
$a
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment