ErrTraffic Webshell Communication

Thiru N@Iamthiru

•updated Jun 17, 2026•2•0•14

This rule detects communication patterns indicative of the ErrTraffic webshell by searching for specific parameters ('wp_debug_session=' and 'mode=php') within web server URI/URL fields. The presence of these parameters suggests an active webshell connection, likely used for remote access and command execution on a compromised web server.