Hidden WordPress admin account created after plugin update
Detects the creation of a new administrator account in WordPress by monitoring for SQL INSERT operations targeting the wp_users and wp_usermeta tables that involve setting the wp_capabilities to administrator. This behavior is indicative of unauthorized account creation often associated with compromised or malicious WordPress plugin updates.
Microsoft Sentinel (KQL)
