TRUNCATE TABLE `#__rsfirewall_signatures`;
INSERT IGNORE INTO `#__rsfirewall_signatures` (`signature`, `type`, `reason`) VALUES
('a2FjYWs=', 'filename', 'PHP Shell variant'),
('aDRja2VyXC50cg==', 'regex', 'PHP Shell - General variant'),
('aGFuaXhhdmlAbXNuLmNvbQ==', 'regex', 'PHP Shell - File uploader'),
('aGVhZGVyKFxzKyk/XChbInwnXShsfEwpb2NhdGlvbjooXHMrKT9odHRwOiguKj8pXCk=', 'regex', 'Possible PHP injection (redirect)'),
('aHR0cFw6Ly9mYnRcLnlhaG9vXC5jb20vY291bnRlclwucGhw', 'regex', 'PHP injection (Russian counter)'),
('aW5pXF9zZXRcKGNoclwo', 'regex', 'PHP injection'),
('aWZcKFwkX1BPU1RcWydnb2xkZW4nXF1cPVw9IkRvbmUiXCk=', 'regex', 'PHP Injection - File uploader'),
('aWZcKGZ1bmN0aW9uX2V4aXN0c1woJ29iX3N0YXJ0J1wpJiYhaXNzZXRcKFwkR0xPQkFMU1xbKC4q\nPylcXVwpXCl7XCRHTE9CQUxTXFsoLio/KVxdPQ==', 'regex', 'PHP injection'),
('b2Jfc3RhcnRcKCJjYWxsYmNrIlwp', 'regex', 'PHP injection'),
('bGl6MHppbQ==', 'filename', 'PHP Shell variant'),
('bTBydGl4', 'filename', 'Backdoor - possible hijacked server'),
('bWFpbChccyspP1woKCJ8JykoLipAKQ==', 'regex', 'Possible PHP injection (mailer)'),
('YmxwYXlsb2FkLnBocA==', 'filename', 'Astroid Framework exploit - malicious payload disguised as a plugin'),
('amNhY2hlcHJvLnBocA==', 'filename', 'Astroid Framework exploit - malicious payload disguised as a plugin'),
('c29zeWV0ZQ==', 'filename', 'PHP Shell variant'),
('c2FmZTB2ZXI=', 'filename', 'PHP Shell variant'),
('c2hcX2RlY3J5cHRcX3BoYXNl', 'regex', 'PHP Injection - Shell'),
('c2hlbGxib3Q=', 'filename', 'Backdoor - possible hijacked server'),
('c3B5bWV0YQ==', 'filename', 'Possible hijacked server'),
('c3RycmV2XCgoJ3wiKWVkb2NlZF80NmVzYWIoJ3wiKVwp', 'regex', 'Possible PHP injection (obfuscated code)'),
('c3RycmV2XChiYXNlNjRfZGVjb2RlXCgoP3MpLio/XClcKQ==', 'regex', 'Possible PHP injection (encoded code - strrev())'),
('c3RyX3JvdDEzXCgncmlueSdcKQ==', 'regex', 'PHP Injection - Obfuscated eval'),
('c3RyX3JvdDEzXChiYXNlNjRfZGVjb2RlXCgoP3MpLio/XClcKQ==', 'regex', 'Possible PHP injection (encoded code - str_rot13())'),
('cGhwc2hlbGw=', 'filename', 'PHP Shell'),
('cGhwcmVtb3Rldmlldw==', 'filename', 'PHP Shell'),
('cHJlZ19yZXBsYWNlXCgiL1wuXCovZSI=', 'regex', 'Possible PHP injection (obfuscated code using /e modifier)'),
('cHJlZ19yZXBsYWNlXChbJ3wiXS9cKFwuXCpcKVwvZQ==', 'regex', 'Possible PHP injection (obfuscated code using /e modifier)'),
('cHMgLWF1eA==', 'regex', 'PHP Shell - suspicious code'),
('cHN5Qk5D', 'filename', 'IRC Client - possible hijacked server'),
('cjBuaW4=', 'filename', 'Exploit - possible hijacked server'),
('cjU3c2hlbGw=', 'filename', 'PHP Shell'),
('cjU3c2hlbGw=', 'regex', 'PHP Shell variant'),
('cjU3XC5nZW5cLnRy', 'regex', 'PHP Shell - General variant'),
('cmFzbGFuNTg=', 'filename', 'Possible hijacked server'),
('dHJ5YWc=', 'filename', 'PHP Shell variant'),
('dm9pZFwucnU=', 'filename', 'Possible hijacked server'),
('dnVsbnNjYW4=', 'filename', 'Vulnerability Scanner - possible hijacked server'),
('dW5kZXJuZXQ=', 'filename', 'IRC Client - possible hijacked server'),
('dzAwdA==', 'filename', 'Exploit - possible hijacked server'),
('emVoaXI0', 'filename', 'PHP Shell variant'),
('J2InLidhcycuJ2U2Jy4nNF8nLidlbicuJ2NvJy4nZGUn', 'regex', 'PHP Injection - base64_decode() obfuscated function call'),
('J2JhcycuJ2U2NF9kJy4nZWNvJy4nZGUn', 'regex', 'PHP Injection - base64_decode() obfuscated function call'),
('J2NyZScuJ2F0ZScuJ19mdW4nLidjdCcuJ2lvJy4nbic=', 'regex', 'PHP Injection - create_function() obfuscated function call'),
('KEAoXCRbYS16MC05XStcKCl7NCx9KQ==', 'regexis', 'PHP Injection - Obfuscated function call'),
('KFthLXowLTlfXStcL1wqKC4qPylcKlwvXCgp', 'regex', 'PHP Injection - Obfuscated function call'),
('KFwkc1xfZnVuYz0oIlthLXpfXSsiW1wuXSl7NCx9KQ==', 'regexis', 'PHP Injection - Obfuscated function name'),
('KFwkW2EtejAtOV0rXHM/XCgpezMsfQ==', 'regexi', 'PHP Injection - Obfuscated function name'),
('KFwkW2EtejAtOV0rXHtbMC05XStcfVxzP1wuP1xzPyl7MTAsfQ==', 'regexis', 'PHP Injection - Obfuscated function name'),
('KFwkW2Etel0rKVwoIlthLXpdIixccz8iIixccz8iW2EtejAtOV9dKyJcKQ==', 'regexis', 'PHP Injection - Obfuscated function name'),
('KFwkZnVuYz0oIlthLXpfXSsiW1wuXSl7NCx9KQ==', 'regexis', 'PHP Injection - Obfuscated function name'),
('KGluY2x1ZGVcX29uY2V8cmVxdWlyZVxfb25jZXxpbmNsdWRlfHJlcXVpcmUpKFxzKyk/KFwoKT9b\nJ3wiXSguKikoXC5wbmd8XC5naWZ8XC5qcGd8XC5qcGVnfFwuaW5pKVsnfCJdKFwpKT8=', 'regex', 'Highly suspicious inclusion (possible CryptoPHP)'),
('KGNoclwoKFswLTldKyl7Myx9XClcLmNoclwoKFswLTldKylcKVwuY2hyXCgoWzAtOV0rKVwpXC5j\naHJcKChbMC05XSspXCkpXC5jaHJcKChbMC05XSspXClcLmNoclwoKFswLTldKylcKQ==', 'regex', 'Possible PHP injection (obfuscated code)'),
('KGpzL2pxdWVyeVwubWluXC5waHAuKj8iXD9kZWZhdWx0X2tleXdvcmRcPSIgXCsgZGVmYXVsdF9r\nZXl3b3JkKQ==', 'regex', 'Search engine referrer hijacking'),
('KHdnZXR8bHlueHxsaW5rc3xjdXJsKSBodHRwcz86XC9cLy4qPzsgcGVybCAuKj8=', 'regex', 'Possible PHP injection (file download and execution)'),
('KHdnZXR8bHlueHxsaW5rc3xjdXJsKSBodHRwcz86XC9cLy4qPzsgY2htb2QgLio/OyBcLlwv', 'regex', 'Possible PHP injection (file download and execution)'),
('KHJlYWxzdGF0aXN0aWNzXC4oaW5mb3xwcm8pfHJlYWxhbmFseXRpY3NcLnByb3xzaXRlYW5hbHl0\naWNzXC5wcm98d2Vic3RhdGlzdGljc1wucHJvfGFkb2Jlc2VjdXJ1cGRhdGVcLmNvbXxtaWNyb3Nv\nZnQtc2VjdXJldHlcLmNvbSk=', 'regexis', 'Realstatistics Malware'),
('KHNoZWxsX2V4ZWN8cGFzc3RocnV8c3lzdGVtfGV4ZWN8cG9wZW4pW1xzK10/XChbXHMrXT9cJChH\nTE9CQUxTfF9TRVJWRVJ8X0dFVHxfUE9TVHxfRklMRVN8X0NPT0tJRXxfU0VTU0lPTnxfUkVRVUVT\nVHxfRU5WKQ==', 'regex', 'Possible PHP injection (binary executed from superglobal variable)'),
('KHNoZWxsX2V4ZWN8cGFzc3RocnV8c3lzdGVtfGV4ZWN8cG9wZW4pXHM/XCgoJ3wiKSh3Z2V0fGx5\nbnh8bGlua3N8Y3VybCk=', 'regex', 'Possible PHP injection (file download)'),
('PCEtLWNoZWNrZXJfc3RhcnQ=', 'regex', 'PHP injection'),
('PFw/cGhwW1xzK117MjQwLH0oLio/KVxz', 'regex', 'Abnormally long spacing after PHP tag - could be used to hide code from view'),
('PGlucHV0IG5hbWU9Ii4qPyIgdHlwZT0iZmlsZSI+', 'regex', 'Possible PHP Shell - File uploader'),
('Q1dTaGVsbER1bXBlcg==', 'filename', 'PHP Shell variant'),
('QFwkW2EtekEtWjAtOV0rXChcJF8oUE9TVHxHRVR8UkVRVUVTVHxDT09LSUUpXFsuKg==', 'regex', 'Possible PHP Injection - obfuscated code execution from Superglobal variable.'),
('REFMbmV0', 'filename', 'IRC Client - possible hijacked server'),
('U2F1ZGkgU2gzbGw=', 'filename', 'PHP Shell variant'),
('UEhQSmlhTWlcLkNvbQ==', 'regexi', 'PHP Injection - Shell'),
('UEhQZW5jb2Rlcg==', 'regex', 'PHP Encoded file - PHPencoder variant, please review manually'),
('VXBsb2FkIEdhZ2Fs', 'regex', 'PHP Shell - File uploader'),
('X2lsX2V4ZWNcKFwp', 'regex', 'Possible risk - ionCube encrypted file'),
('XC5ydS8=', 'filename', 'Possible hijacked server'),
('XC9ldGNcL3Bhc3N3ZA==', 'regex', 'PHP Shell - suspicious code'),
('XC9qcXVlcnlcLm1pblwucGhw', 'regex', 'PHP Injection - Search engine hijacker'),
('XCgiL1thLXpBLVowLTldKy9lIiw=', 'regex', 'Possible PHP injection (obfuscated code using /e modifier)'),
('XChnemluZmxhdGVcKGJhc2U2NF9kZWNvZGVcKCg/cykuKlwp', 'regex', 'Possible PHP injection (compressed code - gzip)'),
('XCR1cGxvYWRmaWxlIFw9IFwkX1BPU1RcWyJwdCJcXVwuXCRfRklMRVNcWyJmaWxlIlxdXFsibmFt\nZSJcXQ==', 'regex', 'PHP Shell - File uploader'),
('XCR1YVw9QFwkX1NFUlZFUlxbIkhUVFBfVVNFUl9BR0VOVCJcXTtcJHJvd1w9c3BsaXRcKCJcPVw9\nXD0iLFwkdWFcKQ==', 'regex', 'PHP Injection - Shell'),
('XCR3cF9hZGRfZmlsdGVyXCg=', 'regex', 'PHP injection (obfuscated code)'),
('XCRbXiAtfl0rXCguKj9cKTs=', 'regex', 'Possible PHP Injection - Characters outside of typing range.'),
('XCRbYS16MC05XSs9XCRfQ09PS0lF', 'regex', 'Possible PHP Injection - superglobal variable obfuscation.'),
('XCRbYS16MC05XSsgPSBcJFxfUE9TVFxbJ1thLXowLTldKydcXTsuQD9wYXNzdGhydVwoXCRbYS16\nXStcKTs=', 'regexis', 'PHP Injection - Shell'),
('XCRbYS16MC05XStccz89XHM/XCRbYS16MC05XStcKCJbYS16MC05XSsiLFxzPyIiLFxzPyJbYS16\nMC05XStcX1thLXowLTldKyJcKTs=', 'regex', 'PHP Injection - Obfuscated function call'),
('XCRcXyhGSUxFU3xTRVJWRVJ8UE9TVHxHRVQpXFsiKFtBLVphLXpcX10rKT8oXFx4WzAtOUEtRmEt\nZl17MSwyfSl7MSx9KFtBLVphLXpcX10rKT9cIl0=', 'regex', 'PHP Injection - Obfuscated Superglobal variable.'),
('XCRfR0VUXFsicGluZyJcXSBcPVw9IFwoInBpbmdfaG9zdCJcKQ==', 'regex', 'PHP Mass Mailer'),
('XCRfR0VUXFsnbWFpbHpvcidcXQ==', 'regex', 'PHP Injection - Mass mailer'),
('XCRfR0VUXFsnc3dzJ1xdXD1cPSAncGhwaW5mbyc=', 'regex', 'PHP Shell variant'),
('XCRfUE9TVFxbJ2NtZCdcXVw9XD0icGhwX2V2YWwi', 'regex', 'PHP Shell variant'),
('XCRfW2EtekEtWl09X19GSUxFX187XCRfW2EtekEtWl09', 'regex', 'PHP injection (obfuscated code)'),
('XCRHTE9CQUxTXFsnKFthLXpdKyk/KFswLTldKyk/J11cKA==', 'regex', 'Possible PHP injection (code executed through superglobal variable)'),
('XCRHTE9CQUxTXFtcJEdMT0JBTFNcWydbYS16MC05XSsnXF1cW1swLTldK1xd', 'regex', 'PHP Injection'),
('XCRjdXJyZW50IFw9IGh0bWxlbnRpdGllcyBcKFwkX1NFUlZFUiBcWydQSFBfU0VMRidcXSBcLiAi\nXD9kaXJcPSIgXC4gXCRkaXJcKQ==', 'regex', 'PHP Injection'),
('XCRmcm9tX25hbWVcPXJhbmRUZXh0XChcKQ==', 'regexi', 'PHP Mass Mailer - random \"from\" address'),
('XCRRQkRCNTFFMjVCRjlBN0YzRDI0NzUwNzI4MDNEMUMzNkQ=', 'regex', 'PHP Shell variant compressed'),
('XCRyZWRfaG9zdC9cJGZha2Vfc2NyaXB0', 'regex', 'PHP Injection'),
('XF9bMC05XStcKFswLTldK1wp', 'regex', 'Possible PHP Injection - function name contains only numbers.'),
('XFx4NDdcXHg0Y1xceDRmQlxceDQxXFx4NGNcXHg1Mw==', 'regex', 'PHP Injection - GLOBALS obfuscated variable call'),
('XFx4NjJcXDE0MVxceDczXFwxNDVcXHgzNlxcNjRcXHg1ZlxcMTQ0XFx4NjVcXDE0M1xceDZmXFwx\nNDRcXHg2NQ==', 'regex', 'PHP Injection - base64_decode() obfuscated function call'),
('XkdJRjg5OyhbXlxuXSpcbispKyhcPFw/cGhwKQ==', 'regex', 'PHP injection - Hidden inside GIF file'),
('XlwjW2EtejAtOV0rXCMkKC4qPyleXCNcL1thLXowLTldK1wjJA==', 'regexms', 'PHP Injection - Page hijacker'),
('XlwkcGFzc3dvcmRcPUBcJF9SRVFVRVNUXFsncGFzc3dvcmQnXF07', 'regexm', 'Possible PHP Injection'),
('Y2hyXChcKFswLTldK1wtWzAtOV0rXClcKQ==', 'regex', 'Possible PHP Injection - Obfuscated code'),
('Y2N0ZWFtXC5ydQ==', 'regex', 'PHP Shell variant'),
('Y3dpbmdz', 'filename', 'PHP Shell'),
('Y3JlYXRlXF9mdW5jdGlvblwoXCdcJFwnKC4qKQ==', 'regex', 'Possible PHP injection (create_function() call)'),
('YmFzaF9oaXN0b3J5', 'filename', 'Possible hijacked server'),
('Yml0Y2h4', 'filename', 'IRC Client - possible hijacked server'),
('YnJ1dGUgKmZvcmNl', 'filename', 'Bruteforce'),
('YW50aWNoYXQ=', 'filename', 'PHP Shell variant'),
('YWN0PXBocGluZm8=', 'regex', 'PHP Shell variant'),
('Yzk5c2hlbGw=', 'filename', 'PHP Shell'),
('Yzk5c2hlbGw=', 'regex', 'PHP Shell variant'),
('Z3VhcmRzZXJ2aWNlcw==', 'filename', 'Possible hijacked server'),
('ZGllXChtZDVcKFwnW2EtejAtOV9dK1wnXClcKTs=', 'regexis', 'PHP Injection - Shell'),
('ZGlyZWN0bWFpbA==', 'filename', 'Mailer - possible hijacked server'),
('ZWdnZHJvcA==', 'filename', 'IRC Bot - possible hijacked server'),
('ZWtpbjB4', 'filename', 'PHP Shell variant'),
('ZXhlY1woKC4qKVwvYmluXC9zaA==', 'regex', 'Possible PHP injection (shell execution)'),
('ZXZhbFtcc10/XChbXHNdP2Jhc2U2NF9kZWNvZGVcKFtcc10/Lio/XClcKQ==', 'regex', 'Possible PHP injection (encoded code - base64)'),
('ZXZhbFwoc3RyaXBzbGFzaGVzXChcJF8oLio/KVwpXCk=', 'regex', 'Possible PHP injection (code executed from superglobal variable)'),
('ZXZhbFwoIlw/XD4iXC5iYXNlNjRfZGVjb2Rl', 'regex', 'Possible PHP injection (encoded code - base64)'),
('ZXZhbFwoW2EtekEtWjAtOV0rXChbJGEtekEtWjAtOV0r', 'regex', 'Possible PHP injection (code executed through obfuscated functions)'),
('ZXZhbFwoXCRbYS16QS1aMC05XStcKFwkW2EtekEtWjAtOV0rXChcJFthLXpBLVowLTldKw==', 'regex', 'PHP Injection - Obfuscated code'),
('ZXZhbFwoXCRcX1BPU1RcWyJbYS16XSsiXF1cKQ==', 'regex', 'PHP Injection - Code executed from $_POST request'),
('ZXZhbFwoXCRfKC4qPylcKQ==', 'regex', 'Possible PHP injection (code executed from superglobal variable)'),
('ZXZhbFwoYmFzZTY0X2RlY29kZVwoKD9zKS4qP1wpXCk=', 'regex', 'Possible PHP injection (encoded code - base64)'),
('ZXZhbFwvXCooLiopXCpcL1wo', 'regexis', 'Obfuscated eval()'),
('ZXZhbFwvXCpcKlwvXCg=', 'regex', 'Hidden eval()'),
('aGFja2xpbmtcLnB3', 'regex', 'URL call to black-market SEO platform'),
('bmFtZVw9YSB2YWx1ZVw9J0ZpbGVzV2luJw==', 'regex', 'PHP Shell'),
('XDxiXD5nYWdhbA', 'regex', 'PHP Shell'),
('XDxpbnB1dCB0eXBlXD1maWxlIG5hbWVcPWZcPg', 'regex', 'PHP Shell'),
('bWQ1XChcJF9QT1NUXFsicGFzc3dvcmQiXF1cKSA/XD1cPSA/Wyd8Il0oW2EtejAtOV0pezMyfVsnfCJd', 'regexis', 'PHP Shell'),
('W2EtejAtOV9dKzo6Z1woJ1thLXpfXC4sJyBdKydcKQ', 'regexis', 'PHP Shell'),
('YmFzZTY0X2RlY29kZVwoc3RycmV2XChzdHJfcm90MTNcKFwk', 'regexis', 'PHP base64 obfuscation'),
('aW1wbG9kZVwoJycsXHM/YXJyYXlfbWFwXCgnW0EtWl0rJyxccz9zdHJfc3BsaXRcKC4qXClcKVwp', 'regex', 'PHP variable obfuscation'),
('KGluY2x1ZGV8cmVxdWlyZSlcX29uY2Vccz9cKD8oInwnKShcXHhbMC03YS1mXXsyfSk', 'regexis', 'PHP file inclusion obfuscation'),
('ImgiXC4iZSJcLiJ4IlwuIjIiXC4iYiJcLiJpIlwuIm4i', 'regexis', 'PHP variable obfuscation'),
('KHVnZ2NmP1w6XC9cL1thLXpcLjAtOVwvXSsp', 'regexis', 'PHP str_rot13 encoded URL'),
('KG1kNVwoKXszLH0=', 'regexi', 'Possible PHP injection (multiple MD5() function calls)'),
('KGluY2x1ZGVcX29uY2VcL1wqLipcKlwvKQ==', 'regexi', 'PHP Injection - Obfuscated code');