Compromised WordPress Site Used as C2 Relay

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects potential command and control (C2) activity where a compromised WordPress site is used as a relay. It specifically looks for HTTP POST requests to URIs containing "wp-admin" with a data size greater than 1000 bytes. A threshold of 5 such events within 60 seconds from the same source IP triggers the alert, indicating a potential high volume of C2 communication.