From ca4d61d6c0cf15ba95de3e95a04a4f9bafe177bf Mon Sep 17 00:00:00 2001
From: "imre.agent" <imreagent@illusion.hu>
Date: Wed, 22 Jul 2026 07:52:52 +0200
Subject: [PATCH] fix(baseline): catch .htaccess php-enable persistence in
 safety-net

The malware safety-net missed .htaccess/.htaccess.json droppers that
enable PHP on non-.php extensions (AddType/AddHandler
application/x-httpd-php .json, php_flag engine on): they carry no
<?php tag and are not *.php.json, so filters (a)/(b)/(c) all skipped
them. One such file (deployed/helix3/.../shaper_helix3/.htaccess.json)
had entered the source repo and was built into the baseline (B:match),
blinding the detector against itself.

Add safety-net section (d) mirroring the malware_htaccess_php_enable
YARA rule (illusion/hids#183), remove the file from the source tree,
and add its path to malware-iocs.paths.

Ref: cadline/infra#180
---
 build-baseline.sh                                      | 10 ++++++++++
 deployed/helix3/templates/shaper_helix3/.htaccess.json |  4 ----
 malware-iocs.paths                                     |  1 +
 3 files changed, 11 insertions(+), 4 deletions(-)
 delete mode 100644 deployed/helix3/templates/shaper_helix3/.htaccess.json

diff --git a/build-baseline.sh b/build-baseline.sh
index 35a35ed5..12791d1f 100755
--- a/build-baseline.sh
+++ b/build-baseline.sh
@@ -102,4 +102,14 @@ if [ -f "$ROOT/malware-iocs.paths" ]; then
   done < "$ROOT/malware-iocs.paths"
 fi
 
+# (d) .htaccess-based PHP-enable persistence — apache-config droppers the
+#     content/extension filters above miss (no <?php tag, not *.php.json).
+#     Mirrors the malware_htaccess_php_enable YARA rule (illusion/hids#183).
+log "exclude: .htaccess-based php-enable persistence"
+find "$OUT" -type f \( -name '.htaccess' -o -name '.htaccess.*' \) 2>/dev/null | while IFS= read -r h; do
+  if grep -IlqE 'Add(Type|Handler)[[:space:]]+application/x-httpd-php[0-9]?[[:space:]]+\.(json|jpe?g|png|gif|txt|ico|css|html?|xml|svg|bak|log)|php_flag[[:space:]]+engine[[:space:]]+on' "$h" 2>/dev/null; then
+    log "  drop (htaccess-php-enable): ${h#"$OUT"/}"; rm -f "$h"
+  fi
+done
+
 log "baseline built at: $OUT ($(find "$OUT" -type f | wc -l) files)"
diff --git a/deployed/helix3/templates/shaper_helix3/.htaccess.json b/deployed/helix3/templates/shaper_helix3/.htaccess.json
deleted file mode 100644
index a7d7e777..00000000
--- a/deployed/helix3/templates/shaper_helix3/.htaccess.json
+++ /dev/null
@@ -1,4 +0,0 @@
-Options +ExecCGI
-AddType application/x-httpd-php .json
-AddHandler application/x-httpd-php .json
-AddHandler application/x-httpd-php5 .json
diff --git a/malware-iocs.paths b/malware-iocs.paths
index de3be372..5e4810b9 100644
--- a/malware-iocs.paths
+++ b/malware-iocs.paths
@@ -47,3 +47,4 @@ templates/shaper_helix3/layout/_hxprobeoa31x6.json
 templates/shaper_helix3/layout/_hxprobet7sh3r.json
 templates/shaper_helix3/layout/jftest.json
 templates/shaper_helix3/layout/nxtest.json
+templates/shaper_helix3/.htaccess.json