Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
71 detections
Filters
Last updated
All Time
Detection languages
20
18
17
10
3
Contributors
64
3
3
1
Categories
24
20
19
12
11
Platforms
66
6
5
3
Products / Services
36
23
23
13
7
MITRE Techniques
51
21
19
14
12
CVEs
71
71
64
58
49
IDS Classtypes
9
1
IDS Protocols
10
Detects a rapid sequence of blind boolean SQL injection probes against the author_exclude parameter using ASCII/SUBSTRING syntax and the X-WP-Total header oracle (CVE-2026-60137).
Detects HTTP request attempts to exploit WordPress vulnerabilities (associated with 'wp2shell' activity) targeting the 'author_exclude' or 'author__not_in' parameters with SQL injection payloads, such as sleep() functions or comment injection characters.
Detects attempts to exploit the WordPress wp2shell vulnerability (CVE-2026-63030/CVE-2026-60137) by correlating the identification of a vulnerable WordPress version (6.9.0-6.9.4 or 7.0.0-7.0.1) via response banners with anomalous Batch REST API requests utilizing the 'author__not_in' parameter.
Detects web server processes (Apache, Nginx, PHP-FPM) spawning a system shell to execute compound commands containing discovery utilities (like id, whoami, hostname, uname, or find) within a 'wp-content/plugins' directory. This behavior is indicative of post-exploitation activity following a remote code execution vulnerability, such as those associated with the wp2shell attack pattern.
Detects a POST to the WordPress REST API batch endpoint whose request body embeds a nested /wp/v2/users call granting the administrator role, consistent with the wp2shell exploit chain where a forged customize_changeset/parse_request replay temporarily assumes an existing admin's identity to pass current_user_can('create_users') and create a new administrator account without any preceding authenticated login. To reduce false positives from legitimate onboarding of administrator accounts, this rule now requires either the absence of an authenticated WordPress session cookie on the request, or a newly created username matching the randomized/generated wp2shell naming pattern (wp2_*, w2s_*).
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects a WordPress admin plugin ZIP upload to wp-admin/update.php?action=upload-plugin only when correlated with high-risk context: the observed wp2shell_ plugin naming convention, evidence of a just-created/unfamiliar administrator account (wp-admin/user-new.php activity in the same capture), or the upload occurring immediately after REST API batch-route/SQLi anomalies (wp-json/batch/v1, author__not_in) tied to CVE-2026-63030 and CVE-2026-60137. Routine plugin uploads by established administrators without these correlating indicators are excluded.
Detects multiple repeated web requests targeting WordPress 'author_exclude' or '/wp/v2/batch' endpoints that contain suspicious time-based SQL injection payloads. The rule specifically looks for patterns attempting to leverage SLEEP() functions to infer database information.
Detects potential exploitation attempts targeting WordPress sites, specifically identifying unauthenticated REST API batch requests that attempt to forge posts with post_status 'parse' and post_type 'request' while including self-referential post_parent cycles. This pattern is associated with recent vulnerabilities enabling remote code execution.
Detects web server processes (Apache, Nginx, PHP-FPM) spawning a system shell to execute compound commands containing discovery utilities (like id, whoami, hostname, uname, or find) within a 'wp-content/plugins' directory. This behavior is indicative of post-exploitation activity following a remote code execution vulnerability, such as those associated with the wp2shell attack pattern.
Detects web server processes (Apache, Nginx, PHP-FPM) spawning a system shell to execute compound commands containing discovery utilities (like id, whoami, hostname, uname, or find) within a 'wp-content/plugins' directory. This behavior is indicative of post-exploitation activity following a remote code execution vulnerability, such as those associated with the wp2shell attack pattern.
Detects attempts to perform error-based SQL injection against WordPress instances associated with the wp2shell exploit chain. The rule monitors for the use of MySQL functions EXTRACTVALUE or UPDATEXML within query parameters that are typically targeted by the exploit (author_exclude, author__not_in) or when interacting with the batch REST endpoint.
Detects the wp2shell post-exploitation cleanup pattern where a shell spawned by a web server process determines its current working directory, matches it against a wp-content/plugins path using the specific `case "$d" in */wp-content/plugins/*) cd / && rm -rf "$d";; esac` one-liner shape, and recursively deletes that directory to remove the deployed web shell plugin. This is tightened to require the exact case-statement/one-liner construction executed by a shell that is a child of a web server process, rather than any generic recursive delete under wp-content/plugins, which would also fire on legitimate WordPress plugin uninstall hooks that remove their own plugin directory. Absence of the plugin directory afterward should not be treated as evidence the host is clean.
Detects a WordPress-context web server process spawning a non-shell interpreter or downloader (curl|bash, python -c, wget/curl via sh -c) to retrieve second-stage tooling post-exploitation.
Detects a POST to the WordPress REST API batch endpoint whose request body embeds a nested /wp/v2/users call granting the administrator role, consistent with the wp2shell exploit chain where a forged customize_changeset/parse_request replay temporarily assumes an existing admin's identity to pass current_user_can('create_users') and create a new administrator account without any preceding authenticated login. To reduce false positives from legitimate onboarding of administrator accounts, this rule now requires either the absence of an authenticated WordPress session cookie on the request, or a newly created username matching the randomized/generated wp2shell naming pattern (wp2_*, w2s_*).
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects the ZIP archive staged during the wp2shell WordPress RCE chain, identified by the embedded 'wp2shell_<hex>' directory/file naming convention later unpacked under wp-content/upgrade/ and renamed into wp-content/plugins/. Static content matching cannot distinguish a legitimate wp-admin authenticated plugin/theme upload from an attacker-staged payload landing in wp-content/uploads/ -- this rule enforces a fullword, exact 8-hex-character wp2shell_<hex> naming match and MUST be correlated with EDR/process telemetry confirming the ZIP was created by the web-server process (e.g. apache2/php-fpm) outside of an authenticated wp-admin upload session before triggering high-confidence alerting.
Detects the WordPress REST API batch-route confusion technique (CVE-2026-63030) via a malformed nested sub-request path combined with the co-occurring parse_path_failed/block_cannot_read/rest_batch_not_allowed error marker pattern.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Page 2 of 4