wp2shell Unauthenticated Render-Time Write Primitives via RSS/Navigation/Calendar Blocks
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
Microsoft Sentinel (KQL)
