imre.agent
5603690a72
The "clean" baseline unintentionally shipped ~34 planted webshells/backdoors
plus sbtrack (a third-party SEO-cloaking proxy) and inert scanner probes,
carried in from the vetted-live Helix3 template. They survived because the IOC
safety net keyed on extension ('*.php.json') while the attacker disguised one
webshell under ~20 fake extensions (.inc.json/.phar.json/.php[3-5].json/
.php.json.json) plus plain-.json defacements.
- History rewritten (git filter-repo) to remove all 48 files from every commit.
- build-baseline.sh step 6 is now CONTENT-based: any templates/**/*.json with a
PHP open tag is dropped (legit Helix3 presets are pure JSON).
- malware-iocs.paths extended with plain-.json defacements, probe artifacts and
non-.json droppers a content grep cannot key on.
Found by the imrcli HIDS YARA union layer during baseline integration (the
baseline-diff alone would have marked them baseline-match).
Assisted-by: claude-code@claude-opus-4-8
50 lines
2.2 KiB
Plaintext
50 lines
2.2 KiB
Plaintext
# Machine-readable malware/planted paths (docroot-relative) excluded from the baseline.
|
|
# Consumed by build-baseline.sh step 6. Rationale + IOC detail in malware-iocs.md.
|
|
# NOTE: the 3 injected core files (auth/joomla.php, session/storage.php, event/event.php)
|
|
# are NOT listed here — they are RESTORED to clean vanilla by the official core package.
|
|
wp-stomp.php
|
|
hyjhxp.php
|
|
libraries/joomla/session/cache.php
|
|
administrator/components/com_joomlaupdate/never.php
|
|
modules/mod_seolite
|
|
modules/mod_articles_single
|
|
modules/mod_al_upload/b8.php
|
|
modules/mod_course_list/a1.php
|
|
templates/trada/html/mod_articles_category/meant.php
|
|
templates/category/tiny.php
|
|
templates/system/links.db
|
|
components/com_extplorer
|
|
administrator/components/com_extplorer
|
|
components/com_joml_incf
|
|
administrator/components/com_joml_incf
|
|
components/com_sys_rom
|
|
administrator/components/com_sys_rom
|
|
|
|
# --- 2026 incidens: a vetted-live Helix3-ból behozott, kiterjesztés-álcázott
|
|
# droppek/defacementek/probe-k + sbtrack cloaking-proxy (security-cleanup).
|
|
# A PHP-tagos .json droppeket a build-baseline.sh step 6/(a) tartalom-alapon fogja;
|
|
# az alábbiak (plain-.json defacement/probe + non-.json .php) explicit listán.
|
|
language/en-GB/en-GB.php
|
|
modules/mod_jsnusers/tmpl/index.php
|
|
sbtrack.php
|
|
templates/beez3/info.php
|
|
templates/shaper_helix3/cox.json
|
|
templates/shaper_helix3/layout/5ce342d1feeb3297_xri6l4eq.json
|
|
templates/shaper_helix3/layout/6etar.json
|
|
templates/shaper_helix3/layout/8a38e129e76e80ff_d3h48ag1.json
|
|
templates/shaper_helix3/layout/9cb22468b5254cb4_zaaafntq.json
|
|
templates/shaper_helix3/layout/cox.json
|
|
templates/shaper_helix3/layout/_d1337_vuln_probe.json
|
|
templates/shaper_helix3/layout/dummy.json
|
|
templates/shaper_helix3/layout/_hxep1rur.json
|
|
templates/shaper_helix3/layout/_hxepn2vl.json
|
|
templates/shaper_helix3/layout/_hxepqjbw.json
|
|
templates/shaper_helix3/layout/_hxepqvk3.json
|
|
templates/shaper_helix3/layout/_hxeptiha.json
|
|
templates/shaper_helix3/layout/_hxepx62d.json
|
|
templates/shaper_helix3/layout/_hxprobe8myf1c.json
|
|
templates/shaper_helix3/layout/_hxprobeoa31x6.json
|
|
templates/shaper_helix3/layout/_hxprobet7sh3r.json
|
|
templates/shaper_helix3/layout/jftest.json
|
|
templates/shaper_helix3/layout/nxtest.json
|