The malware safety-net missed .htaccess/.htaccess.json droppers that
enable PHP on non-.php extensions (AddType/AddHandler
application/x-httpd-php .json, php_flag engine on): they carry no
<?php tag and are not *.php.json, so filters (a)/(b)/(c) all skipped
them. One such file (deployed/helix3/.../shaper_helix3/.htaccess.json)
had entered the source repo and was built into the baseline (B:match),
blinding the detector against itself.
Add safety-net section (d) mirroring the malware_htaccess_php_enable
YARA rule (illusion/hids#183), remove the file from the source tree,
and add its path to malware-iocs.paths.
Ref: cadline/infra#180
ca4d61d6c0
