UpdraftCentral channel request followed by WordPress plugin install and new admi

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•4

Detects a sequence where an UpdraftCentral management request is made to a WordPress site followed by plugin installation or user creation requests from the same source within a 30-minute window, potentially indicating unauthorized plugin installation or webshell deployment via compromised management endpoints.