Rank Math PRO 3.0.123 trojanized plugin: PHP files written to mu-plugins or rank
Detects web server processes writing PHP files into sensitive WordPress directories (such as mu-plugins or rank-math-pro/includes) shortly after deleting them within a 1-hour window. This behavior often indicates the rebuilding or updating of a webshell or backdoor for persistence.
Microsoft Sentinel (KQL)
