Merge pull request 'fix(baseline): catch .htaccess php-enable persistence in the safety-net' (#8) from fix/htaccess-safety-net into main

Reviewed-on: #8

build-baseline.sh

@@ -102,4 +102,14 @@ if [ -f "$ROOT/malware-iocs.paths" ]; then
   done < "$ROOT/malware-iocs.paths"
 fi
 
+# (d) .htaccess-based PHP-enable persistence — apache-config droppers the
+#     content/extension filters above miss (no <?php tag, not *.php.json).
+#     Mirrors the malware_htaccess_php_enable YARA rule (illusion/hids#183).
+log "exclude: .htaccess-based php-enable persistence"
+find "$OUT" -type f \( -name '.htaccess' -o -name '.htaccess.*' \) 2>/dev/null | while IFS= read -r h; do
+  if grep -IlqE 'Add(Type|Handler)[[:space:]]+application/x-httpd-php[0-9]?[[:space:]]+\.(json|jpe?g|png|gif|txt|ico|css|html?|xml|svg|bak|log)|php_flag[[:space:]]+engine[[:space:]]+on' "$h" 2>/dev/null; then
+    log "  drop (htaccess-php-enable): ${h#"$OUT"/}"; rm -f "$h"
+  fi
+done
+
 log "baseline built at: $OUT ($(find "$OUT" -type f | wc -l) files)"

deployed/helix3/templates/shaper_helix3/.htaccess.json

@@ -1,4 +0,0 @@
-Options +ExecCGI
-AddType application/x-httpd-php .json
-AddHandler application/x-httpd-php .json
-AddHandler application/x-httpd-php5 .json

malware-iocs.paths

@@ -47,3 +47,4 @@ templates/shaper_helix3/layout/_hxprobeoa31x6.json
 templates/shaper_helix3/layout/_hxprobet7sh3r.json
 templates/shaper_helix3/layout/jftest.json
 templates/shaper_helix3/layout/nxtest.json
+templates/shaper_helix3/.htaccess.json