WordPress admin account created shortly after web shell access

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•1

Detects the creation of a WordPress administrator account within one hour of a recorded web request to a known web shell path (Mushr00w) or suspect plugin upload directory. This correlation is a high-fidelity indicator of post-exploitation persistence and administrative account hijacking.