rules:
- rule:
    description: Auto Immunity rule generated on 2025-12-04 04:50:54.533022+00:00
    detection: s:f|u|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|s|s|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|s|s|s|m|s|s|s|s|s|s|s|u|u|u|u|h|u|u|u|u|m|m|m|s|s|s|s|s|s|s|s|s|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|h|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|
    id: 80000
    script: /home/tgmisefred/public_html/wp-content/mu-plugins/index.php
- rule:
    description: Auto Immunity rule generated on 2025-12-04 04:50:54.533041+00:00
    detection: s:f|u|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|s|s|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|s|s|s|m|s|s|s|s|s|s|s|u|u|u|u|h|u|u|u|u|m|m|m|s|s|s|s|s|s|s|s|s|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|h|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|n|n|
    id: 80001
    script: /home/tgmisefred/public_html/wp-content/mu-plugins/index.php
- rule:
    description: Auto Immunity rule generated on 2025-12-04 06:45:19.371500+00:00
    detection: s:f|u|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|s|s|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|s|s|s|m|s|s|s|s|s|s|s|u|u|u|u|h|u|u|u|u|m|m|m|s|s|s|s|s|s|s|s|s|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|h|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|
    id: 80002
    script: /home/tgmisefred/public_html/wp-content/mu-plugins/index.php
- rule:
    description: Auto Immunity rule generated on 2025-12-05 01:51:23.384991+00:00
    detection: s:f|u|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|s|s|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|s|s|s|m|m|m|m|s|s|s|s|s|s|s|s|s|s|s|s|m|m|s|s|s|s|s|s|s|u|u|u|u|h|u|u|u|u|m|m|m|s|s|s|s|s|s|s|s|s|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|h|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|
    id: 80003
    script: /home/tgmisefred/public_html/wp-content/mu-plugins/index.php
- rule:
    description: Auto Immunity rule generated on 2025-12-07 09:27:53.701695+00:00
    detection: s:f|u|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|s|s|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|s|s|s|m|s|s|s|s|s|s|s|u|u|u|u|h|u|u|u|u|m|m|m|s|s|s|s|s|s|s|s|s|s|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|h|s|s|s|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|u|
    id: 80004
    script: /home/tgmisefred/public_html/wp-content/mu-plugins/index.php
- rule:
    description: Auto Immunity rule generated on 2026-05-23 06:41:49.346351+00:00
    detection: s:f|f|s|s|s|s|
    id: 89101
    script: /home/phoicdxb/public_html/shell.php
- rule:
    description: Auto Immunity rule generated on 2026-05-26 09:05:12.330235+00:00
    detection: s:f|s|
    id: 89102
    script: /home/phoicdxb/public_html/file.php
- rule:
    description: Auto Immunity rule generated on 2026-05-26 09:05:12.330255+00:00
    detection: s:f|f|
    id: 89103
    script: /home/phoicdxb/public_html/file.php
- rule:
    description: Auto Immunity rule generated on 2026-06-04 07:05:02.154603+00:00
    detection: s:s|s|s|s|s|s|s|s|s|s|s|s|s|s|s|s|s|s|s|s|s|s|s|s|s|s|q|o|s|o|o|o|s|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|s|s|s|s|s|s|o|n|o|q|o|o|s|q|o|o|s|q|o|q|o|o|q|x|o|o|o|o|q|o|o|o|q|o|q|o|o|o|o|x|s|s|s|s|s|s|s|s|s|f|q|o|q|o|o|q|x|o|o|o|o|q|o|o|o|
    id: 89104
    script: /home/phoicdxb/public_html/wp-admin/css/colors/blue/clasa99.php
- rule:
    description: Auto Immunity rule generated on 2026-06-06 02:46:26.085998+00:00
    detection: s:f|o|q|o|s|o|o|o|s|o|o|o|o|o|o|o|o|o|o|s|s|s|s|s|s|o|n|o|q|o|o|s|q|o|o|s|q|o|q|o|o|q|x|o|o|o|o|q|o|o|o|q|o|q|o|o|o|o|x|s|s|s|s|s|s|s|s|s|f|q|o|q|o|o|q|x|o|o|o|o|q|o|o|o|
    id: 89105
    script: /home/phoicdxb/public_html/wp-admin/images/clasa99.php
- rule:
    description: Auto Immunity rule generated on 2026-06-08 01:13:32.569583+00:00
    detection: s:f|o|q|o|s|o|o|o|s|o|o|o|o|o|o|o|o|o|o|o|o|o|o|o|s|s|s|s|s|s|o|n|o|q|o|o|s|q|o|o|s|q|o|q|o|o|q|x|o|o|o|o|q|o|o|o|q|o|q|o|o|o|o|x|s|s|s|s|s|s|s|s|s|f|q|o|q|o|o|q|x|o|o|o|o|q|o|o|o|
    id: 89106
    script: /home/phoicdxb/public_html/wp-admin/js/widgets/clasa99.php
- rule:
    description: Auto Immunity rule generated on 2026-06-18 14:03:21.840128+00:00
    detection: s:f|s|o|s|s|o|s|s|o|s|s|o|s|s|o|s|s|s|s|s|q|o|
    id: 89107
    script: /home/elmkvzcm/public_html/wp-content/td_cache/td_analyze/css/normal.php
- rule:
    description: Auto Immunity rule generated on 2026-06-18 17:12:36.757478+00:00
    detection: s:f|f|f|e|e|e|e|s|o|s|s|o|s|s|o|s|s|o|s|s|o|s|s|o|s|s|o|s|s|o|s|s|o|s|s|o|s|s|o|s|s|o|s|s|o|s|s|s|s|s|q|o|
    id: 89108
    script: /home/dmmkifel/public_html/wp-admin/network/publik-eval.php
- rule:
    danger_files: 89100
    description: Header redirection block
    detection: c:n|
    file_op_name: r:Location\:\shttp
    funcname: header
    id: 89100
    script: '*'
- rule:
    description: Auto Immunity rule generated on 2026-06-23 07:51:38.332426+00:00
    detection: s:f|f|w|f|f|f|s|s|w|q|f|
    id: 89109
    script: /home/myxlsnta/public_html/app/Exceptions/hand.php
- rule:
    description: Auto Immunity rule generated on 2026-06-23 07:51:38.332456+00:00
    detection: s:f|f|s|s|w|q|f|
    id: 89110
    script: /home/myxlsnta/public_html/app/Exceptions/hand.php
