Compromised Website C2 Communication

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•7

This rule detects HTTP POST requests where the URI contains both 'wp-content' and 'uploads', indicating potential command and control (C2) communication from a compromised website, likely a WordPress site. The rule specifically looks for requests with a body size greater than 500 bytes, suggesting data exfiltration or command execution.