The "clean" baseline unintentionally shipped ~34 planted webshells/backdoors
plus sbtrack (a third-party SEO-cloaking proxy) and inert scanner probes,
carried in from the vetted-live Helix3 template. They survived because the IOC
safety net keyed on extension ('*.php.json') while the attacker disguised one
webshell under ~20 fake extensions (.inc.json/.phar.json/.php[3-5].json/
.php.json.json) plus plain-.json defacements.
- History rewritten (git filter-repo) to remove all 48 files from every commit.
- build-baseline.sh step 6 is now CONTENT-based: any templates/**/*.json with a
PHP open tag is dropped (legit Helix3 presets are pure JSON).
- malware-iocs.paths extended with plain-.json defacements, probe artifacts and
non-.json droppers a content grep cannot key on.
Found by the imrcli HIDS YARA union layer during baseline integration (the
baseline-diff alone would have marked them baseline-match).
Assisted-by: claude-code@claude-opus-4-8
Re-architect the baseline as constituents + a generator script (build-baseline.sh)
instead of a checked-out deployed tree: a deployed Joomla docroot differs from the
repo/source layout, so the script manifest-maps packaged extensions (lib/jmap.py),
places no-source and Cadline files, applies core overrides, excludes malware/data,
and emits out/ = the code baseline the operator HIDS verifier consumes.
Adds RUNBOOK.md (recipe+inventory), PROVENANCE.md (upstream map), malware-iocs.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
