valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 10:05:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Backdoored PHP Zlib

Browse Source
This commit is contained in:
Florian Roth 2021-03-29 10:57:01 +02:00
parent 7c5bd51a17
commit 29ee22a895
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
yara/vul_php_zlib_backdoor.yar Normal file
View File

@ -0,0 +1,14 @@
rule VULN_PHP_Hack_Backdoored_Zlib_Zerodium_Mar21_1 {
meta:
description = "Detects backdoored PHP zlib version"
author = "Florian Roth"
reference = "https://www.bleepingcomputer.com/news/security/phps-git-server-hacked-to-add-backdoors-to-php-source-code/"
date = "2021-03-29"
strings:
$x1 = "REMOVETHIS: sold to zerodium, mid 2017" fullword ascii
$x2 = "HTTP_USER_AGENTT" ascii fullword
condition:
filesize < 3000KB and
all of them
}