WordPress/WooCommerce XML-RPC and login brute-force after user enumeration

ills3c Intel&Coffee@Ills3C

•updated 5 days ago•0•0•5

Detects high volume POST requests to WordPress authentication or RPC endpoints (xmlrpc.php or wp-login.php) from external IPs, correlating whether the source previously enumerated WordPress users via wp-json/wp/v2/users or author parameters.