WordPress web server process spawns child shortly after admin session creation

Emiliano Mema@Nosalva

•updated Jul 22, 2026•1•0•2

This rule detects when a web server process (such as apache, httpd, or php-fpm) modifies or creates a new PHP file within common WordPress directories (plugins or themes). This behavior is often indicative of an attacker attempting to plant a web shell to gain or maintain persistent access to a compromised server.