ca4d61d6c0
The malware safety-net missed .htaccess/.htaccess.json droppers that enable PHP on non-.php extensions (AddType/AddHandler application/x-httpd-php .json, php_flag engine on): they carry no <?php tag and are not *.php.json, so filters (a)/(b)/(c) all skipped them. One such file (deployed/helix3/.../shaper_helix3/.htaccess.json) had entered the source repo and was built into the baseline (B:match), blinding the detector against itself. Add safety-net section (d) mirroring the malware_htaccess_php_enable YARA rule (illusion/hids#183), remove the file from the source tree, and add its path to malware-iocs.paths. Ref: cadline/infra#180
51 lines
2.2 KiB
Plaintext
51 lines
2.2 KiB
Plaintext
# Machine-readable malware/planted paths (docroot-relative) excluded from the baseline.
|
|
# Consumed by build-baseline.sh step 6. Rationale + IOC detail in malware-iocs.md.
|
|
# NOTE: the 3 injected core files (auth/joomla.php, session/storage.php, event/event.php)
|
|
# are NOT listed here — they are RESTORED to clean vanilla by the official core package.
|
|
wp-stomp.php
|
|
hyjhxp.php
|
|
libraries/joomla/session/cache.php
|
|
administrator/components/com_joomlaupdate/never.php
|
|
modules/mod_seolite
|
|
modules/mod_articles_single
|
|
modules/mod_al_upload/b8.php
|
|
modules/mod_course_list/a1.php
|
|
templates/trada/html/mod_articles_category/meant.php
|
|
templates/category/tiny.php
|
|
templates/system/links.db
|
|
components/com_extplorer
|
|
administrator/components/com_extplorer
|
|
components/com_joml_incf
|
|
administrator/components/com_joml_incf
|
|
components/com_sys_rom
|
|
administrator/components/com_sys_rom
|
|
|
|
# --- 2026 incidens: a vetted-live Helix3-ból behozott, kiterjesztés-álcázott
|
|
# droppek/defacementek/probe-k + sbtrack cloaking-proxy (security-cleanup).
|
|
# A PHP-tagos .json droppeket a build-baseline.sh step 6/(a) tartalom-alapon fogja;
|
|
# az alábbiak (plain-.json defacement/probe + non-.json .php) explicit listán.
|
|
language/en-GB/en-GB.php
|
|
modules/mod_jsnusers/tmpl/index.php
|
|
sbtrack.php
|
|
templates/beez3/info.php
|
|
templates/shaper_helix3/cox.json
|
|
templates/shaper_helix3/layout/5ce342d1feeb3297_xri6l4eq.json
|
|
templates/shaper_helix3/layout/6etar.json
|
|
templates/shaper_helix3/layout/8a38e129e76e80ff_d3h48ag1.json
|
|
templates/shaper_helix3/layout/9cb22468b5254cb4_zaaafntq.json
|
|
templates/shaper_helix3/layout/cox.json
|
|
templates/shaper_helix3/layout/_d1337_vuln_probe.json
|
|
templates/shaper_helix3/layout/dummy.json
|
|
templates/shaper_helix3/layout/_hxep1rur.json
|
|
templates/shaper_helix3/layout/_hxepn2vl.json
|
|
templates/shaper_helix3/layout/_hxepqjbw.json
|
|
templates/shaper_helix3/layout/_hxepqvk3.json
|
|
templates/shaper_helix3/layout/_hxeptiha.json
|
|
templates/shaper_helix3/layout/_hxepx62d.json
|
|
templates/shaper_helix3/layout/_hxprobe8myf1c.json
|
|
templates/shaper_helix3/layout/_hxprobeoa31x6.json
|
|
templates/shaper_helix3/layout/_hxprobet7sh3r.json
|
|
templates/shaper_helix3/layout/jftest.json
|
|
templates/shaper_helix3/layout/nxtest.json
|
|
templates/shaper_helix3/.htaccess.json
|