To be coherent with other definitions and more precise in general, the signature should be `ET WEB_SERVER ATTACKER WebShell *`.