Merge pull request #3838 from citrin/x-php-eval

[Rules] Micro-optimize X_PHP_EVAL
4 years ago · 00175f9b9b
1 changed files with 1 additions and 1 deletions
--- a/rules/regexp/compromised_hosts.lua
+++ b/rules/regexp/compromised_hosts.lua
@ -92,7 +92,7 @@ reconf['HAS_X_ANTIABUSE'] = {
 }

 reconf['X_PHP_EVAL'] = {
-  re = "X-PHP-Script=/eval\\(\\)\\'d/Hi || X-PHP-Originating-Script=/eval\\(\\)\\'d/Hi",
+  re = [[X-PHP-Script=/eval\(\)'d code/H || X-PHP-Originating-Script=/eval\(\)'d code/H]],
  description = "Message sent using eval'd PHP",
  score = 4.0,
  group = "compromised_hosts"