Add filesize check

nbs-system · Jun 30, 2015 · 97b6069 · 97b6069
1 parent 77e5a33
commit 97b6069
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/malwares.yara b/malwares.yara
@@ -21,7 +21,7 @@ private rule IsPhp
         $xml = "<?xml"
 
     condition:
-        $php and not $xml
+        $php and not $xml and filesize < 5MB
 }
 
 private rule IRC