fix false positives on /etc/hosts caused by unescaped . character

[erinish]

The dot character in these regular expressions is matching any character instead of a literal dot, causing strings like "camcom" to match ^[^#]*ca.com resulting in a false positive.

The fix is to escape the dot so it matches literal dot. I've tested this on my own systems and it seems to correctly match on "ca.com" and no longer match any string with a character between ca and com.

[SitoRBJ]

Hello @erinish,

Thank you for your contribution, we consider very important the collaboration of the community as it helps us to grow and improve.

We have tested the changes and indeed have cases of false positives:

• Rootkit file

root@manager:/etc# cat /var/ossec/etc/rootcheck/rootkit_trojans.txt
. . .
/etc/hosts  !^[^#]*avp\.ch!Anti-virus site on the hosts file
/etc/hosts  !^[^#]*avp.ru!Anti-virus site on the hosts file
/etc/hosts  !^[^#]*awaps\.net! Anti-virus site on the hosts file
/etc/hosts  !^[^#]*ca.com! Anti-virus site on the hosts file
. . . 

• Hosts file

root@manager:/etc# cat hosts
. . .
dnsavpxch       truenegative
dnsavp.ru       truepositive
dnsawaps.net    truepositive
dnscapcom       falsepositive
. . .

With this configuration we would only have to have alerts for "dnsavp.ru" and "dnsawaps.net".

** Alert 1531825408.117790: - ossec,rootcheck,gdpr_IV_35.7.d,
2018 Jul 17 13:03:28 manager->rootcheck
Rule: 510 (level 7) -> 'Host-based anomaly detection event (rootcheck).'
Trojaned version of file '/etc/hosts' detected. Signature used: '^[^#]*avp.ru' (Anti-virus site on the hosts file).
title: Trojaned version of file detected.
file: /etc/hosts

** Alert 1531825408.118141: - ossec,rootcheck,gdpr_IV_35.7.d,
2018 Jul 17 13:03:28 manager->rootcheck
Rule: 510 (level 7) -> 'Host-based anomaly detection event (rootcheck).'
Trojaned version of file '/etc/hosts' detected. Signature used: '^[^#]*awaps\.net' (Anti-virus site on the hosts file).
title: Trojaned version of file detected.
file: /etc/hosts

** Alert 1531825408.118496: - ossec,rootcheck,gdpr_IV_35.7.d,
2018 Jul 17 13:03:28 manager->rootcheck
Rule: 510 (level 7) -> 'Host-based anomaly detection event (rootcheck).'
Trojaned version of file '/etc/hosts' detected. Signature used: '^[^#]*ca.com' (Anti-virus site on the hosts file).
title: Trojaned version of file detected.
file: /etc/hosts

But we also have an alert for "dnscapcom".

Kind regards,

Alfonso Ruiz-Bravo