Trying to ignore a Perl script, but still getting alerts

[GoWilkes]

I've been getting a ton of "suspicious process" alerts lately about a Perl script that hasn't been modified since 2020. So I'm pretty sure these are false alerts.

The email says:

Time: Tue Dec 12 15:18:14 2023 -0500
PID: 19935 (Parent PID:23922)
Account: nobody
Uptime: 99 seconds


Executable:

/usr/bin/perl


Command Line (often faked in exploits):

/usr/bin/perl /home/example/public_html/cgi-bin/cart.cgi

So I added this to csf.pignore via WHM, and of course let WHM restart lfd:

Code: Select all

pexe:/home/example/public_html/cgi-bin/cart\.cgi

I'm still getting emailed alerts on it, though.

The code looks right to me, so what have I done wrong?

[Sergio]

Try this instead:

Code: Select all

 cmd:/usr/bin/perl /home/example/public_html/cgi-bin/cart.cgi

Sergio

[GoWilkes]

That worked, thanks :-)

[Sergio]

Great to know it worked for you, your welcome.