Malicious Plugin Installed on Web Application

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects HTTP POST requests to a web server where the URI contains both 'plugin' and 'install' (case-insensitive). This combination of keywords in a POST request URI could indicate an attempt to install a malicious plugin on a web application.