ErrTraffic Webshell Communication Detected

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•6

Detects web access logs matching the specific 'wp_debug_session' parameter used by the ErrTraffic webshell to communicate with compromised servers. This rule identifies HTTP requests containing both 'wp_debug_session=' and 'mode=php' in the URI query string, which are indicators of ErrTraffic webshell activity.