I have a Xen VM running Debian Stretch with Apache2 to play around with. I have installed ClamAV and Modsecurity (not doing anything just logging at the moment). I keep getting emails from ClamAV stating that it detects a virus Win.Exploit.Unicode_Mixed-1 in the Modsec log files.
luke@lamp:~$ sudo clamscan -i /var/log/apache2/ /var/log/apache2/modsec_audit.log.7.gz: Win.Exploit.Unicode_Mixed-1 FOUND ----------- SCAN SUMMARY ----------- Known viruses: 6107846 Engine version: 0.100.3 Scanned directories: 1 Scanned files: 60 Infected files: 1 Data scanned: 111.06 MB Data read: 23.27 MB (ratio 4.77:1) Time: 42.726 sec (0 m 42 s) luke@lamp:~$
I have submitted the file to VirusTotal.com. ClamAV is the only one to detect on the logfile. This has been going on for months now. Freshclam is keeping ClamAV updated as well.
Is there a way an actual log file can be infected? Is there a way to whitelist the rotating logfiles without whitelisting the signature?
But what i really want to know is this; is there a way to find out what is in the log that is triggering the detection?
EDIT: i managed to locate the string in the logfile. it is;
Now that I found the string causing the detection, how can I find out what it is supposed to do? It is in the "If" line of the log excerpt below.
--0a71b754-A-- [09/Apr/2019:16:10:10 +0800] XKxTYn8AAQEAAGyvyjUAAAAI 126.96.36.199 18716 <local IP of server> 80 --0a71b754-B-- PROPFIND / HTTP/1.1 Host: localhost Connection: Close Content-Length: 0 If: <http://localhost/aaaaaaa潨硣睡焳椶䝲稹䭷佰畓穏䡨噣浔桅㥓偬啧杣㍤䘰硅楒吱䱘橑牁䈱瀵塐㙤汇$