Fix ET Open detection display in live monitor + add more webshell signatures
Issues fixed:
1. ET detection was running but not displaying results
- Detection was happening but only stored in intelligence DB
- Display was showing old attack detection instead
- Now shows ET detection with 🛡️ icon and attack types
- Shows rate anomaly score with 🌊 icon when elevated
2. Added more webshell signatures:
- alfa/alfa-rex/alfanew (Alfa Team shells)
- mini.php, phpspy, antichat, idx, indoxploit
- Suspicious PHP files in wrong locations (admin.php in wp-includes, etc.)
Display format changes:
- Old: [01:25:35] 194.5.82.127 | Score:100 [CRITICAL] | ❓85 | /alfa-rex.php
- New: [01:25:35] 194.5.82.127 | Score:100 [CRITICAL] | 🛡️ET:WEBSHELL,TRAVERSAL | /alfa-rex.php
Features:
- Uses ET score if higher than legacy score
- Shows both ET detection and legacy detection when appropriate
- Rate flooding adds to combined score
- Auto-blocks at combined score ≥90
Tested:
- alfa-rex.php: Score 100, WEBSHELL detected ✅
- admin.php: Score 100, WEBSHELL detected ✅
- ws.php7: Score 95, UPLOAD detected ✅
- All syntax validated ✅
cschantz
dd163f6db1