Expand offline review checks and fix relative output finalization

src/netscaler_triage/data/filesystem_rules.json

@@ -97,6 +97,118 @@
       "required_any_literal": [
         "nsconfig"
       ]
+    },
+    {
+      "id": "httpd_commented_security_directive",
+      "regex": "^[ \\t]*#[ \\t]*(?:Require[ \\t]+all[ \\t]+denied|php_flag[ \\t]+engine[ \\t]+off)\\b",
+      "description": "An Apache restriction is commented out. Compare with a trusted configuration of the same build; comments can be vendor defaults.",
+      "source": "",
+      "required_any_literal": [
+        "#"
+      ],
+      "path_regex": "(?:^|/)(?:httpd|nshttpd)\\.conf$"
+    },
+    {
+      "id": "httpd_php_handler_review",
+      "regex": "^[ \\t]*AddHandler[ \\t]+application/x-httpd-php\\b",
+      "description": "PHP handler declaration. Check the mapped extensions and vendor baseline; a handler alone is not malicious.",
+      "source": "",
+      "required_any_literal": [
+        "addhandler"
+      ],
+      "path_regex": "(?:^|/)(?:httpd|nshttpd)\\.conf$"
+    },
+    {
+      "id": "startup_python_reference",
+      "regex": "(?:/flash)?/nsconfig/rc\\.netscaler[^\\r\\n]{0,300}\\bpython(?:[23](?:\\.\\d+)?)?\\b",
+      "description": "Python is referenced alongside the startup configuration path. Verify actual file contents and administrative intent.",
+      "source": "",
+      "required_any_literal": [
+        "rc.netscaler"
+      ]
+    },
+    {
+      "id": "core_file_removal",
+      "regex": "\\brm[ \\t]+(?:-[a-z]+[ \\t]+){0,3}[\\x22\\x27]?/var/core/\\*",
+      "description": "A command references removal of core files. This can be maintenance or evidence deletion; a logged command alone does not prove execution.",
+      "source": "",
+      "required_any_literal": [
+        "/var/core/"
+      ],
+      "path_regex": "(?:^|/)(?:notice|sh|bash)\\.log(?:\\.|$)"
+    },
+    {
+      "id": "wsfed_request_id_anomaly",
+      "regex": "WSFed:[ \\t]*request_id[^\\r\\n]{0,2048}(?:[\\x80-\\xff\\xfe]|\\^[^\\r\\n]{0,256}\\^)",
+      "description": "WS-Federation request ID contains unusual characters. Encoding, corruption and malformed input are alternatives; this does not prove memory disclosure.",
+      "source": "",
+      "required_any_literal": [
+        "wsfed:"
+      ],
+      "path_regex": "(?:^|/)ns\\.log(?:\\.|$)"
+    },
+    {
+      "id": "acs_control_marker",
+      "regex": "acs=<[^\\r\\n]{0,2048}\\xf0\\^M[^\\r\\n]{0,2048}>,[ \\t]*for",
+      "description": "ACS field contains an unusual byte/control representation. Inspect original bytes and authentication context; not proof of memory disclosure.",
+      "source": "",
+      "required_any_literal": [
+        "acs=<"
+      ],
+      "path_regex": "(?:^|/)ns\\.log(?:\\.|$)"
+    },
+    {
+      "id": "web_artifact_response_review",
+      "regex": "(?:nsginstaller\\.deb|nsgclient[^\\s\\x22?]*|[0-9a-f]{6}\\.ico)[^\\r\\n\\x22]{0,512}HTTP/1\\.[01]\\x22[ \\t]+(?:404|202)[ \\t]+[0-9]{4}\\b",
+      "description": "A candidate artifact returned 202 or 404 with a four-digit response size. Status and size do not establish a web shell; inspect response content and filesystem evidence.",
+      "source": "",
+      "required_any_literal": [
+        "nsginstaller",
+        "nsgclient",
+        ".ico"
+      ],
+      "path_regex": "(?:^|/)httpaccess[^/]*$"
+    },
+    {
+      "id": "web_artifact_error_review",
+      "regex": "(?:File does not exist|not found|\\[error\\])[^\\r\\n]{0,1024}(?:nsginstaller\\.deb|nsgclient|[0-9a-f]{6}/\\.sig)",
+      "description": "Web server error mentions a candidate artifact. A missing-file error usually supports absence at that moment, not successful installation.",
+      "source": "",
+      "required_any_literal": [
+        "nsginstaller",
+        "nsgclient",
+        "/.sig"
+      ],
+      "path_regex": "(?:^|/)httperror[^/]*$"
+    },
+    {
+      "id": "packet_engine_open_file_review",
+      "regex": "^NSPPE\\S*[ \\t]+\\d+[^\\r\\n]{0,1024}(?:/var/netscaler/|callhome)",
+      "description": "A captured open-file listing associates NSPPE with a candidate path. Inspect file type and process context; legitimate open files can match.",
+      "source": "",
+      "required_any_literal": [
+        "nsppe"
+      ]
+    },
+    {
+      "id": "web_user_process_review",
+      "regex": "^(?:nobody|daemon)[ \\t]+\\d+[ \\t]+(?!(?:[^\\r\\n]*)(?:/bin/httpd|/usr/sbin/nshttpd)\\b)[^\\r\\n]{1,2048}$",
+      "description": "A captured process listing contains a non-httpd process under a web-service account. Validate the executable and parent; legitimate helper processes can match.",
+      "source": "",
+      "required_any_literal": [
+        "nobody",
+        "daemon"
+      ]
+    },
+    {
+      "id": "startup_python_content",
+      "regex": "^[ \\t]*(?!#)[^\\r\\n]{0,512}\\bpython(?:[23](?:\\.\\d+)?)?\\b",
+      "path_regex": "(?:^|/)(?:flash/)?nsconfig/rc\\.netscaler$",
+      "description": "Python in startup configuration; compare with authorized configuration.",
+      "source": "",
+      "required_any_literal": [
+        "python"
+      ]
     }
   ]
 }