[[ fm.text ]] Click here
WEBSHELL_PHP_DEC_ENCODE_GENERIC

YARA detection rule by Arnim Rupp modified by OPSWAT · Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
PHP webshell are encoded in decimal blob, that can be loaded by another loader
rule WEBSHELL_PHP_DEC_ENCODE_GENERIC : hardened
{
	meta:
		description = "PHP webshell are encoded in decimal blob, that can be loaded by another loader"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Arnim Rupp modified by OPSWAT"
		score = 75

	strings:
		$php_short1 = {36 30 20 36 33}
		$php_short2 = {36 30 2c 20 36 33}
		$no_xml1 = {36 30 20 36 33 20 31 32 30 20 31 30 39 20 31 30 38 20 33 32 20 31 31 38 20 31 30 31 20 31 31 34 20 31 31 35 20 31 30 35 20 31 31 31 20 31 31 30}
		$no_xml2 = {36 30 2c 20 36 33 2c 20 31 32 30 2c 20 31 30 39 2c 20 31 30 38 2c 20 33 32 2c 20 31 31 38 2c 20 31 30 31 2c 20 31 31 34 2c 20 31 31 35 2c 20 31 30 35 2c 20 31 31 31 2c 20 31 31 30}
		$no_xml3 = {36 30 20 36 33 20 31 32 30 20 31 30 39 20 31 30 38 20 34 35 20 31 31 35 20 31 31 36 20 31 32 31 20 31 30 38 20 31 30 31 20 31 31 35 20 31 30 34 20 31 30 31 20 31 30 31 20 31 31 36}
		$no_xml4 = {36 30 2c 20 36 33 2c 20 31 32 30 2c 20 31 30 39 2c 20 31 30 38 2c 20 34 35 2c 20 31 35 2c 20 31 31 36 2c 20 31 32 31 2c 20 31 30 38 2c 20 31 30 31 2c 20 31 31 35 2c 20 31 30 34 2c 20 31 30 31 2c 20 31 30 31 2c 20 31 31 36}
		$no_asp1 = {36 30 20 33 37 20 36 34 20 37 36 20 36 35 20 37 38 20 37 31 20 38 35 20 36 35 20 37 31 20 36 39}
		$no_asp2 = {36 30 2c 20 33 37 2c 20 36 34 2c 20 37 36 2c 20 36 35 2c 20 37 38 2c 20 37 31 2c 20 38 35 2c 20 36 35 2c 20 37 31 2c 20 36 39}
		$no_asp3 = {36 30 20 31 31 35 20 39 39 20 31 31 34 20 31 30 35 20 31 31 32 20 31 31 36 20 33 32 20 31 30 38 20 39 37 20 31 31 30 20 31 30 33 20 31 31 37 20 39 37 20 31 30 33 20 31 30 31 20 36 31 20 33 34 20 34 30 20 31 31 38 20 39 38 20 34 31}
		$no_asp4 = {36 30 2c 20 31 31 35 2c 20 39 39 2c 20 31 31 34 2c 20 31 30 35 2c 20 31 31 32 2c 20 31 31 36 2c 20 33 32 2c 20 31 30 38 2c 20 39 37 2c 20 31 31 30 2c 20 31 30 33 2c 20 31 31 37 2c 20 39 37 2c 20 31 30 33 2c 20 31 30 31 2c 20 36 31 2c 20 33 34 2c 20 34 30 2c 20 31 31 38 2c 20 39 38 2c 20 34 31}
		$no_asp5 = {36 30 20 31 31 35 20 39 39 20 31 31 34 20 31 30 35 20 31 31 32 20 31 31 36 20 33 32 20 31 30 38 20 39 37 20 31 31 30 20 31 30 33 20 31 31 37 20 39 37 20 31 30 33 20 31 30 31 20 36 31 20 33 34 20 34 30 20 31 30 36 20 31 31 35 20 39 39 20 31 31 34 20 31 30 35 20 31 31 32 20 31 31 36 20 34 31}
		$no_asp6 = {36 30 2c 20 31 31 35 2c 20 39 39 2c 20 31 31 34 2c 20 31 30 35 2c 20 31 31 32 2c 20 31 31 36 2c 20 33 32 2c 20 31 30 38 2c 20 39 37 2c 20 31 31 30 2c 20 31 30 33 2c 20 31 31 37 2c 20 39 37 2c 20 31 30 33 2c 20 31 30 31 2c 20 36 31 2c 20 33 34 2c 20 34 30 2c 20 31 30 36 2c 20 31 31 35 2c 20 39 39 2c 20 31 31 34 2c 20 31 30 35 2c 20 31 31 32 2c 20 31 31 36 2c 20 34 31}
		$no_asp7 = {36 30 20 31 31 35 20 39 39 20 31 31 34 20 31 30 35 20 31 31 32 20 31 31 36 20 33 32 20 31 30 38 20 39 37 20 31 31 30 20 31 30 33 20 31 31 37 20 39 37 20 31 30 33 20 31 30 31 20 36 31 20 33 34 20 34 30 20 39 39 20 33 35 20 34 31}
		$no_asp8 = {36 30 2c 20 31 31 35 2c 20 39 39 2c 20 31 31 34 2c 20 31 30 35 2c 20 31 31 32 2c 20 31 31 36 2c 20 33 32 2c 20 31 30 38 2c 20 39 37 2c 20 31 31 30 2c 20 31 30 33 2c 20 31 31 37 2c 20 39 37 2c 20 31 30 33 2c 20 31 30 31 2c 20 36 31 2c 20 33 34 2c 20 34 30 2c 20 39 39 2c 20 33 35 2c 20 34 31}
		$no_pdf1 = {36 30 20 36 33 20 31 32 30 20 31 31 32 20 39 37 20 39 39 20 31 30 37 20 31 30 31 20 31 31 36}
		$no_pdf2 = {36 30 2c 20 36 33 2c 20 31 32 30 2c 20 31 31 32 2c 20 39 37 2c 20 39 39 2c 20 31 30 37 2c 20 31 30 31 2c 20 31 31 36}
		$php_new1 = {36 30 20 36 33 20 31 31 32 20 31 30 34 20 31 31 32}
		$php_new2 = {36 30 2c 20 36 33 2c 20 31 31 32 2c 20 31 30 34 2c 20 31 31 32}
		$php_new3 = {36 30 20 31 31 35 20 39 39 20 31 31 34 20 31 30 35 20 31 31 32 20 31 31 36 20 33 32 20 31 30 38 20 39 37 20 31 31 30 20 31 30 33 20 31 31 37 20 39 37 20 31 30 33 20 31 30 31 20 36 31 20 39 32 20 33 34 20 31 31 32 20 31 30 34 20 31 31 32}
		$php_new4 = {36 30 2c 20 31 31 35 2c 20 39 39 2c 20 31 31 34 2c 20 31 30 35 2c 20 31 31 32 2c 20 31 31 36 2c 20 33 32 2c 20 31 30 38 2c 20 39 37 2c 20 31 31 30 2c 20 31 30 33 2c 20 31 31 37 2c 20 39 37 2c 20 31 30 33 2c 20 31 30 31 2c 20 36 31 2c 20 39 32 2c 20 33 34 2c 20 31 31 32 2c 20 31 30 34 2c 20 31 31 32}
		$inp1 = {31 31 32 20 31 30 34 20 31 31 32 20 35 38 20 34 37 20 34 37 20 31 30 35 20 31 31 30 20 31 31 32 20 31 31 37 20 31 31 36}
		$inp2 = {31 31 32 2c 20 31 30 34 2c 20 31 31 32 2c 20 35 38 2c 20 34 37 2c 20 34 37 2c 20 31 30 35 2c 20 31 31 30 2c 20 31 31 32 2c 20 31 31 37 2c 20 31 31 36}
		$inp3 = {33 36 20 39 35 20 37 31 20 36 39 20 38 34 20 39 31}
		$inp4 = {33 36 2c 20 39 35 2c 20 37 31 2c 20 36 39 2c 20 38 34 2c 20 39 31}
		$inp5 = {33 36 20 39 35 20 38 30 20 37 39 20 38 33 20 38 34 20 39 31}
		$inp6 = {33 36 2c 20 39 35 2c 20 38 30 2c 20 37 39 2c 20 38 33 2c 20 38 34 2c 20 39 31}
		$inp7 = {33 36 20 39 35 20 38 32 20 36 39 20 38 31 20 38 35 20 36 39 20 38 33 20 38 34 20 39 31}
		$inp8 = {33 36 2c 20 39 35 2c 20 38 32 2c 20 36 39 2c 20 38 31 2c 20 38 35 2c 20 36 39 2c 20 38 33 2c 20 38 34 2c 20 39 31}
		$inp9 = {39 35 20 38 33 20 36 39 20 38 32 20 38 36 20 36 39 20 38 32 20 39 31 20 33 39 20 37 32 20 38 34 20 38 34 20 38 30 20 39 35}
		$inp10 = {39 35 2c 20 38 33 2c 20 36 39 2c 20 38 32 2c 20 38 36 2c 20 36 39 2c 20 38 32 2c 20 39 31 2c 20 33 39 2c 20 37 32 2c 20 38 34 2c 20 38 34 2c 20 38 30 2c 20 39 35}
		$inp11 = {39 35 20 38 33 20 36 39 20 38 32 20 38 36 20 36 39 20 38 32 20 39 31 20 33 34 20 37 32 20 38 34 20 38 34 20 38 30 20 39 35}
		$inp12 = {39 35 2c 20 38 33 2c 20 36 39 2c 20 38 32 2c 20 38 36 2c 20 36 39 2c 20 38 32 2c 20 39 31 2c 20 33 34 2c 20 37 32 2c 20 38 34 2c 20 38 34 2c 20 38 30 2c 20 39 35}
		$inp13 = {39 37 20 31 31 34 20 31 31 34 20 39 37 20 31 32 31 20 39 35 20 31 31 38 20 39 37 20 31 30 38 20 31 31 37 20 31 30 31 20 31 31 35 20 34 30 20 33 36 20 39 35 20 38 33 20 36 39 20 38 32 20 38 36 20 36 39 20 38 32 20 34 31}
		$inp14 = {39 37 2c 20 31 31 34 2c 20 31 31 34 2c 20 39 37 2c 20 31 32 31 2c 20 39 35 2c 20 31 31 38 2c 20 39 37 2c 20 31 30 38 2c 20 31 31 37 2c 20 31 30 31 2c 20 31 31 35 2c 20 34 30 2c 20 33 36 2c 20 39 35 2c 20 38 33 2c 20 36 39 2c 20 38 32 2c 20 38 36 2c 20 36 39 2c 20 38 32 2c 20 34 31}
		$inp15 = {31 30 33 20 31 30 31 20 31 31 36 20 31 30 31 20 31 31 30 20 31 31 38 20 34 30}
		$inp16 = {31 30 33 2c 20 31 30 31 2c 20 31 31 36 2c 20 31 30 31 2c 20 31 31 30 2c 20 31 31 38 2c 20 34 30}
		$inp17 = {31 30 32 20 31 30 35 20 31 30 38 20 31 30 31 20 39 35 20 31 30 33 20 31 30 31 20 31 31 36 20 39 35 20 39 39 20 31 31 31 20 31 31 30 20 31 31 36 20 31 30 31 20 31 31 30 20 31 31 36 20 31 31 35 20 34 30}
		$inp18 = {31 30 32 2c 20 31 30 35 2c 20 31 30 38 2c 20 31 30 31 2c 20 39 35 2c 20 31 30 33 2c 20 31 30 31 2c 20 31 31 36 2c 20 39 35 2c 20 39 39 2c 20 31 31 31 2c 20 31 31 30 2c 20 31 31 36 2c 20 31 30 31 2c 20 31 31 30 2c 20 31 31 36 2c 20 31 31 35 2c 20 34 30}
		$inp19 = {31 30 32 20 31 31 35 20 31 31 31 20 39 39 20 31 30 37 20 31 31 31 20 31 31 32 20 31 30 31 20 31 31 30 20 34 30}
		$inp20 = {31 30 32 2c 20 31 31 35 2c 20 31 31 31 2c 20 39 39 2c 20 31 30 37 2c 20 31 31 31 2c 20 31 31 32 2c 20 31 30 31 2c 20 31 31 30 2c 20 34 30}
		$inp21 = {31 30 33 20 31 32 32 20 31 30 35 20 31 31 30 20 31 30 32 20 31 30 38 20 39 37 20 31 31 36 20 31 30 31 20 34 30 20 39 38 20 39 37 20 31 31 35 20 31 30 31 20 35 34 20 35 32 20 39 35 20 31 30 30 20 31 30 31 20 39 39 20 31 31 31 20 31 30 30 20 31 30 31 20 34 30}
		$inp22 = {31 30 33 2c 20 31 32 32 2c 20 31 30 35 2c 20 31 31 30 2c 20 31 30 32 2c 20 31 30 38 2c 20 39 37 2c 20 31 31 36 2c 20 31 30 31 2c 20 34 30 2c 20 39 38 2c 20 39 37 2c 20 31 31 35 2c 20 31 30 31 2c 20 35 34 2c 20 35 32 2c 20 39 35 2c 20 31 30 30 2c 20 31 30 31 2c 20 39 39 2c 20 31 31 31 2c 20 31 30 30 2c 20 31 30 31 2c 20 34 30}
		$cpayload1 = {31 30 31 20 31 31 38 20 39 37 20 31 30 38 20 34 30}
		$cpayload2 = {31 30 31 2c 20 31 31 38 2c 20 39 37 2c 20 31 30 38 2c 20 34 30}
		$cpayload3 = {31 30 31 20 31 32 30 20 31 30 31 20 39 39 20 34 30}
		$cpayload4 = {31 30 31 2c 20 31 32 30 2c 20 31 30 31 2c 20 39 39 2c 20 34 30}
		$cpayload5 = {31 31 35 20 31 30 34 20 31 30 31 20 31 30 38 20 31 30 38 20 39 35 20 31 30 31 20 31 32 30 20 31 30 31 20 39 39 20 34 30}
		$cpayload6 = {31 31 35 2c 20 31 30 34 2c 20 31 30 31 2c 20 31 30 38 2c 20 31 30 38 2c 20 39 35 2c 20 31 30 31 2c 20 31 32 30 2c 20 31 30 31 2c 20 39 39 2c 20 34 30}
		$cpayload7 = {31 31 32 20 39 37 20 31 31 35 20 31 31 35 20 31 31 36 20 31 30 34 20 31 31 34 20 31 31 37 20 34 30}
		$cpayload8 = {31 31 32 2c 20 39 37 2c 20 31 31 35 2c 20 31 31 35 2c 20 31 31 36 2c 20 31 30 34 2c 20 31 31 34 2c 20 31 31 37 2c 20 34 30}
		$cpayload9 = {31 31 35 20 31 32 31 20 31 31 35 20 31 31 36 20 31 30 31 20 31 30 39 20 34 30}
		$cpayload10 = {31 31 35 2c 20 31 32 31 2c 20 31 31 35 2c 20 31 31 36 2c 20 31 30 31 2c 20 31 30 39 2c 20 34 30}
		$cpayload11 = {31 31 32 20 31 31 31 20 31 31 32 20 31 30 31 20 31 31 30 20 34 30}
		$cpayload12 = {31 31 32 2c 20 31 31 31 2c 20 31 31 32 2c 20 31 30 31 2c 20 31 31 30 2c 20 34 30}
		$cpayload13 = {31 31 32 20 31 31 34 20 31 31 31 20 39 39 20 39 35 20 31 31 31 20 31 31 32 20 31 30 31 20 31 31 30 20 34 30}
		$cpayload14 = {31 31 32 2c 20 31 31 34 2c 20 31 31 31 2c 20 39 39 2c 20 39 35 2c 20 31 31 31 2c 20 31 31 32 2c 20 31 30 31 2c 20 31 31 30 2c 20 34 30}
		$cpayload15 = {31 31 32 20 39 39 20 31 31 30 20 31 31 36 20 31 30 38 20 39 35 20 31 30 31 20 31 32 30 20 31 30 31 20 39 39 20 34 30}
		$cpayload16 = {31 31 32 2c 20 39 39 2c 20 31 31 30 2c 20 31 31 36 2c 20 31 30 38 2c 20 39 35 2c 20 31 30 31 2c 20 31 32 30 2c 20 31 30 31 2c 20 39 39 2c 20 34 30}
		$cpayload17 = {39 37 20 31 31 35 20 31 31 35 20 31 30 31 20 31 31 34 20 31 31 36 20 34 30}
		$cpayload18 = {39 37 2c 20 31 31 35 2c 20 31 31 35 2c 20 31 30 31 2c 20 31 31 34 2c 20 31 31 36 2c 20 34 30}
		$cpayload19 = {31 31 32 20 31 31 34 20 31 30 31 20 31 30 33 20 39 35 20 31 31 34 20 31 30 31 20 31 31 32 20 31 30 38 20 39 37 20 39 39 20 31 30 31 20 34 30}
		$cpayload20 = {31 31 32 2c 20 31 31 34 2c 20 31 30 31 2c 20 31 30 33 2c 20 39 35 2c 20 31 31 34 2c 20 31 30 31 2c 20 31 31 32 2c 20 31 30 38 2c 20 39 37 2c 20 39 39 2c 20 31 30 31 2c 20 34 30}
		$cpayload21 = {31 30 39 20 39 38 20 39 35 20 31 30 31 20 31 31 34 20 31 30 31 20 31 30 33 20 39 35 20 31 31 34 20 31 30 31 20 31 31 32 20 31 30 38 20 39 37 20 39 39 20 31 30 31 20 34 30}
		$cpayload22 = {31 30 39 2c 20 39 38 2c 20 39 35 2c 20 31 30 31 2c 20 31 31 34 2c 20 31 30 31 2c 20 31 30 33 2c 20 39 35 2c 20 31 31 34 2c 20 31 30 31 2c 20 31 31 32 2c 20 31 30 38 2c 20 39 37 2c 20 39 39 2c 20 31 30 31 2c 20 34 30}
		$cpayload23 = {31 30 39 20 39 38 20 39 35 20 31 30 31 20 31 31 34 20 31 30 31 20 31 30 33 20 31 30 35 20 39 35 20 31 31 34 20 31 30 31 20 31 31 32 20 31 30 38 20 39 37 20 39 39 20 31 30 31 20 34 30}
		$cpayload24 = {31 30 39 2c 20 39 38 2c 20 39 35 2c 20 31 30 31 2c 20 31 31 34 2c 20 31 30 31 2c 20 31 30 33 2c 20 31 30 35 2c 20 39 35 2c 20 31 31 34 2c 20 31 30 31 2c 20 31 31 32 2c 20 31 30 38 2c 20 39 37 2c 20 39 39 2c 20 31 30 31 2c 20 34 30}
		$cpayload25 = {39 39 20 31 31 34 20 31 30 31 20 39 37 20 31 31 36 20 31 30 31 20 39 35 20 31 30 32 20 31 31 37 20 31 31 30 20 39 39 20 31 31 36 20 31 30 35 20 31 31 31 20 31 31 30 20 34 30}
		$cpayload26 = {39 39 2c 20 31 31 34 2c 20 31 30 31 2c 20 39 37 2c 20 31 31 36 2c 20 31 30 31 2c 20 39 35 2c 20 31 30 32 2c 20 31 31 37 2c 20 31 31 30 2c 20 39 39 2c 20 31 31 36 2c 20 31 30 35 2c 20 31 31 31 2c 20 31 31 30 2c 20 34 30}
		$cpayload27 = {38 32 20 31 30 31 20 31 30 32 20 31 30 38 20 31 30 31 20 39 39 20 31 31 36 20 31 30 35 20 31 31 31 20 31 31 30 20 37 30 20 31 31 37 20 31 31 30 20 39 39 20 31 31 36 20 31 30 35 20 31 31 31 20 31 31 30 20 34 30}
		$cpayload28 = {38 32 2c 20 31 30 31 2c 20 31 30 32 2c 20 31 30 38 2c 20 31 30 31 2c 20 39 39 2c 20 31 31 36 2c 20 31 30 35 2c 20 31 31 31 2c 20 31 31 30 2c 20 37 30 2c 20 31 31 37 2c 20 31 31 30 2c 20 39 39 2c 20 31 31 36 2c 20 31 30 35 2c 20 31 31 31 2c 20 31 31 30 2c 20 34 30}
		$cpayload29 = {31 30 32 20 31 30 31 20 31 31 36 20 39 39 20 31 30 34 20 39 37 20 31 30 38 20 31 30 38 20 34 30 20 38 30 20 36 38 20 37 39 20 35 38 20 35 38 20 37 30 20 36 39 20 38 34 20 36 37 20 37 32 20 39 35 20 37 30 20 38 35 20 37 38 20 36 37}
		$cpayload30 = {31 30 32 2c 20 31 30 31 2c 20 31 31 36 2c 20 39 39 2c 20 31 30 34 2c 20 39 37 2c 20 31 30 38 2c 20 31 30 38 2c 20 34 30 2c 20 38 30 2c 20 36 38 2c 20 37 39 2c 20 35 38 2c 20 35 38 2c 20 37 30 2c 20 36 39 2c 20 38 34 2c 20 36 37 2c 20 37 32 2c 20 39 35 2c 20 37 30 2c 20 38 35 2c 20 37 38 2c 20 36 37}
		$cpayload31 = {31 30 39 20 31 31 31 20 31 31 38 20 31 30 31 20 39 35 20 31 31 37 20 31 31 32 20 31 30 38 20 31 31 31 20 39 37 20 31 30 30 20 31 30 31 20 31 30 30 20 39 35 20 31 30 32 20 31 30 35 20 31 30 38 20 31 30 31 20 34 30}
		$cpayload32 = {31 30 39 2c 20 31 31 31 2c 20 31 31 38 2c 20 31 30 31 2c 20 39 35 2c 20 31 31 37 2c 20 31 31 32 2c 20 31 30 38 2c 20 31 31 31 2c 20 39 37 2c 20 31 30 30 2c 20 31 30 31 2c 20 31 30 30 2c 20 39 35 2c 20 31 30 32 2c 20 31 30 35 2c 20 31 30 38 2c 20 31 30 31 2c 20 34 30}
		$cpayload33 = {31 31 32 20 31 31 34 20 31 31 31 20 39 39 20 39 35 20 31 31 31 20 31 31 32 20 31 30 31 20 31 31 30 20 34 30}
		$cpayload34 = {31 31 32 2c 20 31 31 34 2c 20 31 31 31 2c 20 39 39 2c 20 39 35 2c 20 31 31 31 2c 20 31 31 32 2c 20 31 30 31 2c 20 31 31 30 2c 20 34 30}
		$cpayload35 = {31 30 32 20 31 31 34 20 31 30 31 20 39 37 20 31 30 30 20 34 30}
		$cpayload36 = {31 30 32 2c 20 31 31 34 2c 20 31 30 31 2c 20 39 37 2c 20 31 30 30 2c 20 34 30}
		$cpayload37 = {31 30 32 20 31 31 39 20 31 31 34 20 31 30 35 20 31 31 36 20 31 30 31 20 34 30}
		$cpayload38 = {31 30 32 2c 20 31 31 39 2c 20 31 31 34 2c 20 31 30 35 2c 20 31 31 36 2c 20 31 30 31 2c 20 34 30}
		$m_cpayload_preg_filter1_1 = {31 31 32 20 31 31 34 20 31 30 31 20 31 30 33 20 39 35 20 31 30 32 20 31 30 35 20 31 30 38 20 31 31 36 20 31 30 31 20 31 31 34 20 34 30}
		$m_cpayload_preg_filter1_2 = {31 31 32 2c 20 31 31 34 2c 20 31 30 31 2c 20 31 30 33 2c 20 39 35 2c 20 31 30 32 2c 20 31 30 35 2c 20 31 30 38 2c 20 31 31 36 2c 20 31 30 31 2c 20 31 31 34 2c 20 34 30}
		$m_cpayload_preg_filter2_1 = {33 39 20 31 32 34 20 34 36 20 34 32 20 31 32 34 20 31 30 31 20 33 39}
		$m_cpayload_preg_filter2_2 = {33 39 2c 20 31 32 34 2c 20 34 36 2c 20 34 32 2c 20 31 32 34 2c 20 31 30 31 2c 20 33 39}

	condition:
		(( ( $php_short1 in ( 0 .. 100 ) or $php_short1 in ( filesize - 1000 .. filesize ) or $php_short2 in ( 0 .. 100 ) or $php_short2 in ( filesize - 1000 .. filesize ) ) and not any of ( $no_* ) ) or any of ( $php_new* ) ) and ( any of ( $inp* ) ) and ( any of ( $cpayload* ) or ( ( any of ( $m_cpayload_preg_filter1* ) ) and ( any of ( $m_cpayload_preg_filter2* ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

9d3ffa07-228e-425d-ab27-bc20a1336cf7
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
