imre.agent ca4d61d6c0 fix(baseline): catch .htaccess php-enable persistence in safety-net ... The malware safety-net missed .htaccess/.htaccess.json droppers that enable PHP on non-.php extensions (AddType/AddHandler application/x-httpd-php .json, php_flag engine on): they carry no <?php tag and are not *.php.json, so filters (a)/(b)/(c) all skipped them. One such file (deployed/helix3/.../shaper_helix3/.htaccess.json) had entered the source repo and was built into the baseline (B:match), blinding the detector against itself. Add safety-net section (d) mirroring the malware_htaccess_php_enable YARA rule (illusion/hids#183), remove the file from the source tree, and add its path to malware-iocs.paths. Ref: cadline/infra#180		2026-07-22 07:52:52 +02:00
..
plugins	feat(deployed): add Helix3 2.5.5 (no-source, vetted live)	2026-07-16 11:24:48 +02:00
templates/shaper_helix3	fix(baseline): catch .htaccess php-enable persistence in safety-net	2026-07-22 07:52:52 +02:00