Skip to content

Commit fde51fa

Browse files
committed
Deprecate and remove 'hex_general_commands.csv'.
Despite the warning provided in the README file, this particular signature file continues to regularly see support requests relating to the various false positives it causes. Since I'm a little tired of serving the same support request multiple times to different users across different platforms, and I doubt the signature file in question really provides sufficient benefit to justify it anyway, I'm deprecating and removing it.
1 parent ed7a84a commit fde51fa

File tree

3 files changed

+1
-29
lines changed

3 files changed

+1
-29
lines changed

misc/hex_general_commands.csv.gz

-478 Bytes
Binary file not shown.

misc/readme.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
**File** | **Description**
44
---|---
5-
hex_general_commands.csv | **General command detections.** This signature file can detect simple commands such as eval, require, include, unserialize, etc, often found in executable script files. If you happen to allow only very small, "non-binary" (i.e., plain-text) files, small image files for forum avatars and etc to be uploaded, and if your website only deals with low volumes of uploads, this signature file may be useful as a means to detect unwanted, obfuscated executable code and scripting hidden within such files, enabling phpMussel to identify such files as malicious, when they would otherwise appear benign. However, it should be noted that this particular signature file poses a **VERY** high false positive risk! If your phpMussel setup or your website's upload facility deals with more than low volumes of uploads, is expected to process "binary files", anything other than very small files, or is expected to process large images, videos, executable files, etc, then this particular signature file should, in most cases, be avoided.
65
phpmussel.cedb | **phpMussel complex extended signatures.** Contains signatures based on extended metadata generated by phpMussel. Signatures in this signature file target a wide range of miscellaneous threats covering a wide range of formats and vectors, including Android malware, chameleon attacks, forkbombs, web-based ransomware, malicious browser extensions, equation malware, etc. Generally recommended for most phpMussel setups, and has a very low false positive risk.
76
phpmussel.db | **phpMussel standard signatures.** Signatures in this signature file work directly with file content (i.e., with zero or limited pre-processing). Covers a wide range of formats. Generally recommended for most phpMussel setups, and has a low false positive risk.
87
phpmussel_regex.db | **phpMussel standard regex signatures.** Same as the above, except that the signatures in this signature file can contain regular expressions (whereas signatures from the above can't).
@@ -31,4 +30,4 @@ phpmussel_swf_regex.db | **phpMussel SWF regex signatures.** Same as the above,
3130
---
3231

3332

34-
Last Updated: 20 March 2021 (2021.03.20).
33+
Last Updated: 1 April 2021 (2021.04.01).

signatures.dat

Lines changed: 0 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,4 @@
11
---
2-
hex_general_commands.csv:
3-
Name: "General command detections."
4-
Extended Description: >
5-
This signature file can detect simple commands such as eval, require, include, unserialize, etc, often found in
6-
executable script files. It may be useful as a means to detect unwanted, obfuscated executable code and scripting hidden
7-
inside files that could be malicious, but could otherwise appear innocent and harmless, if you happen to allow only very
8-
small, "non-binary" (i.e., plain-text) files to be uploaded, small image files for forum avatars, etc, and if your
9-
website only deals with low volumes of uploads. However, it should be noted that this particular signature file poses a
10-
**VERY** high false positive risk! If your phpMussel setup or your website's upload facility deals with more than low
11-
volumes of uploads, is expected to process "binary files", anything other than very small files, or is expected to
12-
process large images, videos, executable files, etc, then this particular signature file should, in most cases, be
13-
avoided.
14-
Version: "2019.237.608"
15-
Minimum Required: "1.0.0-DEV"
16-
Minimum Required PHP: "5.4.0"
17-
Remote: "https://raw.githubusercontent.com/phpMussel/Signatures/master/signatures.dat"
18-
Uninstallable: true
19-
When Update Succeeds:
20-
- "ClearHashCache"
21-
Files:
22-
From:
23-
- "https://raw.githubusercontent.com/phpMussel/Signatures/master/misc/hex_general_commands.csv.gz"
24-
To:
25-
- "signatures/hex_general_commands.csv"
26-
Checksum:
27-
- "a3f700ccf3aa9ec28c46bef06db88dd6b58e36d207b791b9977f5efe9cadc707:1454"
28-
Reannotate: "signatures.dat"
292
clamav.cedb:
303
Name: "ClamAV complex extended signatures."
314
Extended Description: >

0 commit comments

Comments
 (0)