Rank Math PRO backdoor: .htaccess modified to execute .cache files as PHP
Detects modification or creation of .htaccess files within WordPress directory structures followed within 24 hours by the creation or modification of .cache files in the same directory. This behavioral pattern is often indicative of web shell deployment or persistence installation via compromised web applications.
Microsoft Sentinel (KQL)
