PHP File Creation Under WordPress wp-content/cache via mysqld or Web-Server INTO OUTFILE (wp2shell)
Detects creation of a PHP file under a WordPress wp-content/cache directory attributed either to the mysqld process or to a web-server process (apache2) whose command line contains an INTO OUTFILE-style SQL pattern. In the wp2shell exploit chain, SQL injection reaching author__not_in can be abused to write a webshell via SQL INTO OUTFILE directly into wp-content/cache instead of the plugin-install path, bypassing plugin-directory-focused detections. Requiring database-process or INTO OUTFILE attribution reduces false positives from legitimate caching plugins that generate PHP cache files under this same directory.
Sigma
