Merge pull request #1205 from smfreegard/rules_161129

Adjust scores and add new rules

2 files changed, 11 insertions, 5 deletions

diff --git a/rules/regexp/compromised_hosts.lua b/rules/regexp/compromised_hosts.lua
index 8d224b315..2444b5cb0 100644
--- a/rules/regexp/compromised_hosts.lua
+++ b/rules/regexp/compromised_hosts.lua
@@ -11,7 +11,7 @@ reconf['HAS_PHPMAILER_SIG'] = {
 reconf['PHP_SCRIPT_ROOT'] = {
   re = "X-PHP-Originating-Script=/^0:/Hi",
   description = "PHP Script executed by root UID",
-  score = 2.0,
+  score = 1.0,
   group = "compromised_hosts"
 }
 
@@ -99,14 +99,12 @@ reconf['HAS_WP_URI'] = {
 reconf['WP_COMPROMISED'] = {
   re = '/\\/wp-(?:content|includes)[^\\/]+\\//Ui',
   description = "URL that is pointing to a compromised WordPress installation",
-  score = 5.0,
   group = "compromised_hosts"
 }
 
 reconf['PHP_XPS_PATTERN'] = {
   re = 'X-PHP-Script=/^[^\\. ]+\\.[^\\.\\/ ]+\\/sendmail\\.php\\b/Hi',
   description = "Message contains X-PHP-Script pattern",
-  score = 5.0,
   group = "compromised_hosts"
 }
 
diff --git a/rules/regexp/headers.lua b/rules/regexp/headers.lua
index d05874809..143171ae2 100644
--- a/rules/regexp/headers.lua
+++ b/rules/regexp/headers.lua
@@ -821,7 +821,7 @@ reconf['HAS_INTERSPIRE_SIG'] = {
                      'header_exists(X-Mailer-Sent-By)',
                      'List-Unsubscribe=/\\/unsubscribe\\.php\\?M=[^&]+&C=[^&]+&L=[^&]+&N=[^>]+>$/Xi'),
   description = "Has Interspire fingerprint",
-  score = 3.0,
+  score = 1.0,
   group = 'header'
 }
 
@@ -835,7 +835,7 @@ reconf['CT_EXTRA_SEMI'] = {
 reconf['SUBJECT_ENDS_EXCLAIM'] = {
   re = 'Subject=/!\\s*$/H',
   description = 'Subject ends with an exclaimation',
-  score = 1.0,
+  score = 0.0,
   group = 'headers'
 }
 
@@ -880,3 +880,11 @@ reconf['HAS_ORG_HEADER'] = {
   score = 0.0,
   group = 'headers'
 }
+
+reconf['X_PHPOS_FAKE'] = {
+  re = 'X-PHP-Originating-Script=/^\\d{7}:/Hi',
+  description = 'Fake X-PHP-Originating-Script header',
+  score = 3.0,
+  group = 'headers'
+}
+