K.php - a RestApps malicious script

The opposite. The firewall doesn’t care about invading rules in the OUTPUT chain. And even if it did, just enable custom rules and the check is disabled.