[
    {
        "comment": "--- Backdoor rules ---",

        "rule_id" : "m1",
        "rule_type" : "malware",
        "matching_types":
            [
                "Backdoor"
            ],
        "filename_rules": "",
        "operator": "or",
        "content_rules":
            [
                [
                    {
                        "regex": "(script_family[\\s]*\\([\\s]*\"[\\s]*[mM]alware[\\s]*\"[\\s]*\\));",
                        "group": "*",
                        "operator": "and"
                    },
                    {
                        "regex": "([bB][aA][cC][kK][dD][oO][oO][Rr])"
                    }
                ]
            ]
    }
]