@daemonitor/plugins 1.1.41 → 1.1.42

package/dist/plugins/monitoring/LogWatchPlugin.js

@@ -42,13 +42,6 @@ const BASE64_BLOB = /[A-Za-z0-9+/]{40,}={0,2}/;
 const UPLOADS_PHP = /\/wp-content\/uploads\/.*\.php$/i;
 const PLUGIN_PHP = /\/wp-content\/(?:plugins|mu-plugins)\/.*\.php$/i;
 const BATCH_PATH = /^\/wp-json\/batch\/v1|rest_route=\/?batch\/v1/i;
-// The omnisend-integration mu-plugin's wp_send_json_error "Security check
-// failed" logs as 79 bytes direct from Cloudflare and 90 through cloudflared
-// (since 2026-10-28); success logs as 77 and 88. Matching on size is the only
-// signal the access log carries, so a change to that message, to nginx's gzip
-// settings or to the proxy in front silences this rule.
-const SUBSCRIBE_FAIL_BYTES = new Set([79, 90]);
-const SUBSCRIBE_REFERER = /\/subscribe\/?(?:[?#]|$)/;
 // wp-admin paths that answer 2xx to anonymous callers, so a 2xx on them proves
 // nothing about being logged in. Everything else under /wp-admin/ redirects a
 // logged-out visitor to the login form.
@@ -93,7 +86,7 @@ async function readNew(source, st) {
     st.remainder = lines.pop() ?? ""; // last element is a partial line (no newline)
     return lines;
 }
-export function analyze(lines, cfg, windowSec, st) {
+export function analyze(lines, cfg, windowSec, st, rules = []) {
     const burstThreshold = cfg.xmlrpcBurstThreshold ?? 20;
     const batchIps = new Map(); // ip → count of batch/v1 → 207
     // key (ip, or path for webshells) → the vhosts it was seen against. Only
@@ -123,7 +116,7 @@ export function analyze(lines, cfg, windowSec, st) {
     const adminOkIps = new Set(); // ip that then loaded an authed wp-admin page (2xx)
     const xmlrpcByIp = new Map(); // ip → POST xmlrpc count
     const webshell = new Map(); // pathNoQuery → sample
-    const subscribeFail = new Map(); // ip → "Security check failed" replies
+    const compiled = rules.map((rule) => ({ rule, referer: rule.referer ? new RegExp(rule.referer) : null, hits: new Map() }));
     let total = 0;
     for (const line of lines) {
         const e = parseLine(line);
@@ -174,8 +167,18 @@ export function analyze(lines, cfg, windowSec, st) {
         // every WP site is probed constantly for my.php / academy.php / etc., and
         // those hits 404 (not there) or 403 (WAF-blocked). Alerting on the probes
         // is pure noise; alert only when the shell actually RAN.
-        if (e.method === "POST" && pathNoQuery === "/wp-admin/admin-ajax.php" && SUBSCRIBE_FAIL_BYTES.has(e.bytes) && SUBSCRIBE_REFERER.test(e.referer)) {
-            subscribeFail.set(e.ip, (subscribeFail.get(e.ip) || 0) + 1);
+        for (const { rule, referer, hits } of compiled) {
+            if (rule.method && rule.method !== e.method)
+                continue;
+            if (rule.path && rule.path !== pathNoQuery)
+                continue;
+            if (rule.status && !rule.status.includes(e.status))
+                continue;
+            if (rule.bytes && !rule.bytes.includes(e.bytes))
+                continue;
+            if (referer && !referer.test(e.referer))
+                continue;
+            hits.set(e.ip, (hits.get(e.ip) || 0) + 1);
             noteHost(e.ip, e.host);
         }
         const executed = e.status >= 200 && e.status < 300;
@@ -230,13 +233,16 @@ export function analyze(lines, cfg, windowSec, st) {
             });
         }
     }
-    for (const [ip, count] of subscribeFail) {
-        findings.push({
-            rule: "subscribe-nonce-fail", key: `subscribe-nonce:${ip}`, severity: "warning", ip,
-            path: "/wp-admin/admin-ajax.php",
-            title: "Subscribe form rejected a visitor",
-            detail: `${ip}: "Security check failed" on /subscribe/ (${count}×)${onSites(ip)}, a real signup was turned away`,
-        });
+    for (const { rule, hits } of compiled) {
+        for (const [ip, count] of hits) {
+            const title = rule.title || rule.name;
+            findings.push({
+                rule: rule.name, key: `rule:${rule.name}:${ip}`, severity: rule.severity || "warning", ip,
+                path: rule.path,
+                title,
+                detail: `${ip}: ${title} (${count}×)${onSites(ip)}`,
+            });
+        }
     }
     const counts = {
         total,
@@ -245,7 +251,7 @@ export function analyze(lines, cfg, windowSec, st) {
         batchBlocked,
         xmlrpcPosts: [...xmlrpcByIp.values()].reduce((a, b) => a + b, 0),
         webshellHits: [...webshell.values()].reduce((a, b) => a + b.count, 0),
-        subscribeFail: [...subscribeFail.values()].reduce((a, b) => a + b, 0),
+        ruleHits: compiled.reduce((n, { hits }) => n + [...hits.values()].reduce((a, b) => a + b, 0), 0),
         loginSuccess: st?.hideLogin ? 0 : [...loginOkIps].filter((ip) => adminOkIps.has(ip)).length,
         loginRedirectsAlways: !!st?.hideLogin,
     };
@@ -262,7 +268,7 @@ export function createLogWatchPlugin() {
         if (Array.isArray(cfg.sources) && cfg.sources.length)
             return cfg.sources;
         if (cfg.path)
-            return [{ name: cfg.name, path: cfg.path, fromStart: cfg.fromStart }];
+            return [{ name: cfg.name, path: cfg.path, fromStart: cfg.fromStart, rules: cfg.rules }];
         return [];
     };
     const refreshFn = async (plugin) => {
@@ -280,7 +286,7 @@ export function createLogWatchPlugin() {
             }
             try {
                 const lines = await readNew(source, st);
-                const { findings, counts } = analyze(lines, cfg, windowSec, st);
+                const { findings, counts } = analyze(lines, cfg, windowSec, st, source.rules);
                 await plugin.send({ name: label, source: label, path: source.path, window: windowSec, counts, findings }, uid);
             }
             catch (e) {
@@ -298,6 +304,6 @@ export function createLogWatchPlugin() {
         refreshTimer = null;
         states.clear();
     };
-    return createMonitoringPlugin("logwatch", "logwatch", "Access-log security watcher (WP2Shell / webshell / xmlrpc / subscribe form)", async () => { }, monitorFn, refreshFn, teardownFn);
+    return createMonitoringPlugin("logwatch", "logwatch", "Access-log security watcher (WP2Shell / webshell / xmlrpc / custom rules)", async () => { }, monitorFn, refreshFn, teardownFn);
 }
 export default createLogWatchPlugin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daemonitor/plugins",
-  "version": "1.1.41",
+  "version": "1.1.42",
   "description": "daemonitor plugins",
   "types": "types/index.d.ts",
   "main": "dist/index.js",