diff options
| author | Steve Freegard <steve@stevefreegard.com> | 2016-11-29 16:26:45 +0000 |
|---|---|---|
| committer | Steve Freegard <steve@stevefreegard.com> | 2016-11-29 16:26:45 +0000 |
| commit | 77292906d5658dd289040224d3a29b2c427d97ed (patch) | |
| tree | ea7b4ebe02cb00d9dc7085df0b41122c413d4b26 /rules/regexp/compromised_hosts.lua | |
| parent | 78b0d7d6d4a0fae8c1672348da26842b0ab3976b (diff) | |
| download | rspamd-77292906d5658dd289040224d3a29b2c427d97ed.tar.gz rspamd-77292906d5658dd289040224d3a29b2c427d97ed.zip | |
Adjust scores and add new rules
Diffstat (limited to 'rules/regexp/compromised_hosts.lua')
| -rw-r--r-- | rules/regexp/compromised_hosts.lua | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/rules/regexp/compromised_hosts.lua b/rules/regexp/compromised_hosts.lua index e5e6e6aec..3cf104d23 100644 --- a/rules/regexp/compromised_hosts.lua +++ b/rules/regexp/compromised_hosts.lua @@ -11,7 +11,7 @@ reconf['HAS_PHPMAILER_SIG'] = { reconf['PHP_SCRIPT_ROOT'] = { re = "X-PHP-Originating-Script=/^0:/Hi", description = "PHP Script executed by root UID", - score = 2.0, + score = 1.0, group = "compromised_hosts" } @@ -99,14 +99,12 @@ reconf['HAS_WP_URI'] = { reconf['WP_COMPROMISED'] = { re = '/\\/wp-(?:content|includes)[^\\/]+\\//Ui', description = "URL that is pointing to a compromised WordPress installation", - score = 5.0, group = "compromised_hosts" } reconf['PHP_XPS_PATTERN'] = { re = 'X-PHP-Script=/^[^\\. ]+\\.[^\\.\\/ ]+\\/sendmail\\.php\\b/Hi', description = "Message contains X-PHP-Script pattern", - score = 5.0, group = "compromised_hosts" } |