Click2Shell: WordPress theme dir PHP webshell drop then shell spawn

Arnold Chan@slaz

•updated Sep 19, 2026•1•0•5

This rule detects potential web shell activity by identifying instances where a web server process creates or modifies a PHP file within a 'wp-content/themes' directory, followed closely (within 15 minutes) by that same web server process spawning a shell process (e.g., sh, bash, cmd.exe).