From 32e8992b506b6d1f389942dfd1520e81f3d63ed5 Mon Sep 17 00:00:00 2001 From: nichogenius Date: Mon, 24 Jul 2017 22:32:57 -0600 Subject: [PATCH] preg_replace b64 sample shortened to 'replace' preg_replace should be shortened to just replace as it will also match str_replace, str_ireplace, ereg_replace, eregi_replace and many others I'm sure. Should increase number of hits. 'preg_replace' base64 strings: (removed) cHJlZ19yZXBsYWNl ByZWdfcmVwbGFjZ wcmVnX3JlcGxhY2 'replace' base64 strings: (added) cmVwbGFjZ JlcGxhY2 yZXBsYWNl --- patterns_raw.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/patterns_raw.txt b/patterns_raw.txt index 3682206..45e7e8b 100644 --- a/patterns_raw.txt +++ b/patterns_raw.txt @@ -9,9 +9,9 @@ c3lzdGVt N5c3Rlb zeXN0ZW \x73\x79\x73\x74\x65\x6d' /* case, dec/hex issue? */, // system -cHJlZ19yZXBsYWNl -ByZWdfcmVwbGFjZ -wcmVnX3JlcGxhY2 +cmVwbGFjZ +JlcGxhY2 +yZXBsYWNl \x70\x72\x65\x67\x5f\x72\x65\x70\x6c\x61\x63\x65' /* case, dec/hex issue? */, // preg_replace ZXhlYy V4ZWMo