文件操作 - rfxn.yara

文件: /var/lib/clamav/aaa/rfxn.yara

编辑文件内容

rule Backdoor_PHP_WPVCD_TempExecution {
    meta:
       description = "Backdoor script associated with WP-VCD."

strings:
       $re = /extract\s*$\s*wp_temp_setupx?\s*\(\s*\$\w+\s*$\s*\)/ nocase

condition:
       $re
}

rule Backdoor_PHP_WPVCD_DivCodeName {
    meta:
       description = "Backdoor script associated with WP-VCD"

strings:
       $re = /\$div_code_name\s*\=\s*['"]wp_vcd['"];/ nocase

condition:
       $re
}

rule Backdoor_PHP_WPVCD_Deployer {
    meta:
       description = "Deployment script associated with WP-VCD."

strings:
       $re = /strpos\s*$\s*\$\w{1,40}\s*,\s*['"]WP_V_CD['"]\s*$\s*===\s*false/ nocase

condition:
       $re
}

rule Spam_PHP_WPVCD_ContentInjection {
    meta:
       description = "Content injection script associated with WP-VCD."

strings:
       $re = /\$ip\s*=\s*\@file_get_contents\s*\(\s*ABSPATH\s*\.\s*['"]wp\-includes\/wp\-feed\.php['"]/ nocase

condition:
       $re
}

rule Suspicious_PHP_PrependedInclude {
    meta:
       description = "Suspicious PHP include often associated with WP-VCD."

strings:
       $re = /^\<\?php\s+if\s*$\s*file_exists\s*\(\s*dirname\s*\(\s*__FILE__\s*$\s*\.\s*['"][^'"]+['"]\s*\)\s*\)\s*(include|require)(_once)?\s*$\s*dirname\s*\(\s*__FILE__\s*$\s*\.\s*['"][^'"]+['"]\s*\)\s*\;\s*\?\>\s*\<\?/ nocase

condition:
       $re
}

文件操作 - rfxn.yara

文件: /var/lib/clamav/aaa/rfxn.yara

编辑文件内容

修改文件时间

删除文件