UNC5142 CLEARSHORT JavaScript Injection in WordPress File

Duo Tech@duotech

•updated Oct 17, 2025•1•58

Detects the modification of common WordPress PHP files to include content characteristic of the UNC5142 CLEARSHORT infection chain. This activity is indicative of a compromised web server. This rule requires a File Integrity Monitoring (FIM) solution or EDR that can inspect the contents of modified files.