T1190: LiteSpeed Cache CVE-2024-28000 Auth Bypass & Admin Creation
Detects exploitation attempts against the WordPress LiteSpeed Cache plugin (CVE-2024-28000), including suspicious web requests involving ESI/crawler cookie hash manipulation, execution of known exploit binaries (wp28000, wp28000_cp), and subsequent unauthorized creation of administrator accounts via the WordPress REST API.
Microsoft Sentinel (KQL)
