Props.conf / Regex question

[flo_cognosec]

I add this to props.conf to detect shellscripts, but interesting enough this not only matches shell-scripts but also a lot of other files as well, not matching the regex.

What am I missing ?

[rule::find_shellscript]
MORE_THAN_0 = ^#!\/bin\/(bash|sh)
LEARN_MODEL=false
LEARN_SOURCETYPE=false
sourcetype=shellscript

[flo_cognosec]

Seems like the MORE_THAN / LESS_THAN operators don't actually work as expected , was corrected in the docs already 😞