WordPress Administrator Account Created via REST API with wp2shell IoC Username Prefix (wp2_/w2s_)
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Microsoft Sentinel (KQL)
