Rogue WordPress admin accounts wpsupport_ or @wp-mail.net after Rank Math PRO co
Detects the creation of WordPress administrator accounts using MySQL or WP-CLI command-line tools on hosts, specifically looking for specific username prefixes or email domains associated with suspicious activities.
Microsoft Sentinel (KQL)
