feat(security): malware pattern scanner #259

New Issue

2026-06-23T17:00:33Z

jmiller commented

2026-06-23 17:00:33 +00:00

Malware Pattern Scanner

Overview

Scan PHP and JavaScript files for known malware signatures, web shells, backdoors, and suspicious code patterns. Comparable to RSFirewall malware scanner.

Features

Pattern library — built-in regex patterns for common web shells (c99, r57, WSO, FilesMan, etc.)
Suspicious function detection — base64_decode+eval chains, preg_replace with /e, create_function, assert
Obfuscation detection — flag heavily obfuscated code (high entropy, hex-encoded strings)
File type verification — detect PHP files disguised as images/docs
Scan scope — full site, specific directories, or changed-files-only (integrates with #258 file scanner)
Quarantine — move suspicious files to quarantine directory instead of deleting
Whitelist — mark false positives as safe
Scheduled scanning — periodic automatic scans via task plugin
ntfy alerts — push notifications on malware detection

Architecture

Shares scan infrastructure with file integrity scanner (#258)
Pattern definitions stored in PHP config file (easy to update)
Quarantine directory: administrator/components/com_mokosuiteclient/quarantine/
Results displayed in component view with threat level badges

## Malware Pattern Scanner ### Overview Scan PHP and JavaScript files for known malware signatures, web shells, backdoors, and suspicious code patterns. Comparable to RSFirewall malware scanner. ### Features - **Pattern library** — built-in regex patterns for common web shells (c99, r57, WSO, FilesMan, etc.) - **Suspicious function detection** — base64_decode+eval chains, preg_replace with /e, create_function, assert - **Obfuscation detection** — flag heavily obfuscated code (high entropy, hex-encoded strings) - **File type verification** — detect PHP files disguised as images/docs - **Scan scope** — full site, specific directories, or changed-files-only (integrates with #258 file scanner) - **Quarantine** — move suspicious files to quarantine directory instead of deleting - **Whitelist** — mark false positives as safe - **Scheduled scanning** — periodic automatic scans via task plugin - **ntfy alerts** — push notifications on malware detection ### Architecture - Shares scan infrastructure with file integrity scanner (#258) - Pattern definitions stored in PHP config file (easy to update) - Quarantine directory: `administrator/components/com_mokosuiteclient/quarantine/` - Results displayed in component view with threat level badges

jmiller added this to the v03.00.00 milestone 2026-06-23 17:00:33 +00:00

jmiller commented

2026-06-23 17:00:36 +00:00

Branch created: feature/259-feat-security-malware-pattern-scanner

git fetch origin
git checkout feature/259-feat-security-malware-pattern-scanner

Branch created: [`feature/259-feat-security-malware-pattern-scanner`](https://git.mokoconsulting.tech/MokoConsulting/MokoSuiteClient/src/branch/feature/259-feat-security-malware-pattern-scanner) ```bash git fetch origin git checkout feature/259-feat-security-malware-pattern-scanner ```

Sign in to join this conversation.

Priority Medium

Type Feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoSuiteClient#259