WordPress Theme Editor Abuse for Persistence
Detects interaction with the WordPress Theme Editor utility immediately followed by a file modification to functions.php, indicative of the ErrTraffic deployment phase. This activity is often used by adversaries to establish persistence on compromised WordPress sites by injecting malicious code.
Microsoft Sentinel (KQL)
