Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
71 detections
Filters
Last updated
All Time
Detection languages
20
18
17
10
3
Contributors
64
3
3
1
Categories
24
20
19
12
11
Platforms
66
6
5
3
Products / Services
36
23
23
13
7
MITRE Techniques
51
21
19
14
12
CVEs
71
71
64
58
49
IDS Classtypes
9
1
IDS Protocols
10
Detects a POST to the WordPress REST API batch endpoint whose request body embeds a nested /wp/v2/users call granting the administrator role, consistent with the wp2shell exploit chain where a forged customize_changeset/parse_request replay temporarily assumes an existing admin's identity to pass current_user_can('create_users') and create a new administrator account without any preceding authenticated login. To reduce false positives from legitimate onboarding of administrator accounts, this rule now requires either the absence of an authenticated WordPress session cookie on the request, or a newly created username matching the randomized/generated wp2shell naming pattern (wp2_*, w2s_*).
Detects a forged WordPress customize_changeset post that triggers wp_set_current_user with a mismatched or unauthenticated user context, the privilege-escalation bridge used in the wp2shell admin-takeover chain.
Detects SQL injection syntax smuggled into the author_exclude parameter via the WordPress REST API batch endpoint desync (CVE-2026-60137/CVE-2026-63030).
Detects requests to WordPress plugin-install/upload or privileged user REST endpoints occurring shortly after anomalous WordPress REST API batch activity, consistent with post-exploitation follow-through in the wp2shell chain.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects the wp2shell unauthenticated SQL injection chain (CVE-2026-63030 / CVE-2026-60137) abusing the REST API batch-route confusion via author_exclude/author__not_in parameters against wp-json/wp/v2/posts or wp-json/batch/v1, where the extraction result reflects the WordPress 6.9 $wp$2y$ bcrypt-over-HMAC-SHA384 hash marker in the request query or response body. Requires both the specific unauthenticated REST SQLi vector AND the hash-format marker to fire, excluding legitimate authenticated admin export/reporting tools that reference wp_users through normal means.
Detects potential exploitation attempts targeting WordPress sites, specifically identifying unauthenticated REST API batch requests that attempt to forge posts with post_status 'parse' and post_type 'request' while including self-referential post_parent cycles. This pattern is associated with recent vulnerabilities enabling remote code execution.
Detects the execution of sendmail via a shell (sh, bash, dash) spawned by a web server process (Apache, Nginx, httpd) where the process working directory matches the wp2shell plugin pattern (wp2shell_<hex>). This is indicative of remote code execution or web shell activity associated with the wp2shell vulnerability, where the attacker uses sendmail for exfiltration or command output delivery.
Detects potential exploitation attempts targeting WordPress sites, specifically identifying unauthenticated REST API batch requests that attempt to forge posts with post_status 'parse' and post_type 'request' while including self-referential post_parent cycles. This pattern is associated with recent vulnerabilities enabling remote code execution.
Detects attempts to perform error-based SQL injection against WordPress instances associated with the wp2shell exploit chain. The rule monitors for the use of MySQL functions EXTRACTVALUE or UPDATEXML within query parameters that are typically targeted by the exploit (author_exclude, author__not_in) or when interacting with the batch REST endpoint.
Detects a web server process (apache2/httpd/nginx/php-fpm) spawning a shell interpreter from a WordPress wp-content working directory, the durable behavioral signature of successful wp2shell exploitation regardless of entry vector.
Detects a web server process (apache2/httpd/nginx/php-fpm) spawning a shell interpreter from a WordPress wp-content working directory, the durable behavioral signature of successful wp2shell exploitation regardless of entry vector.
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects the ZIP archive staged during the wp2shell WordPress RCE chain, identified by the embedded 'wp2shell_<hex>' directory/file naming convention later unpacked under wp-content/upgrade/ and renamed into wp-content/plugins/. Static content matching cannot distinguish a legitimate wp-admin authenticated plugin/theme upload from an attacker-staged payload landing in wp-content/uploads/ -- this rule enforces a fullword, exact 8-hex-character wp2shell_<hex> naming match and MUST be correlated with EDR/process telemetry confirming the ZIP was created by the web-server process (e.g. apache2/php-fpm) outside of an authenticated wp-admin upload session before triggering high-confidence alerting.
Detects UNION-based blind SQL injection against the WordPress REST posts item route exploiting the split_the_query bypass (CVE-2026-60137) to exfiltrate database contents.
Detects unauthenticated POST requests to the WordPress REST API batch endpoint (/wp-json/batch/v1 or ?rest_route=/batch/v1) containing a nested requests array or an anomalous sub-request method pattern, the network entry point for the wp2shell CVE-2026-63030/CVE-2026-60137 exploit chain.
Detects attempts to exploit the WordPress wp2shell vulnerability (CVE-2026-63030/CVE-2026-60137) by correlating the identification of a vulnerable WordPress version (6.9.0-6.9.4 or 7.0.0-7.0.1) via response banners with anomalous Batch REST API requests utilizing the 'author__not_in' parameter.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects a web server process (apache2/httpd/nginx/php-fpm) spawning a shell interpreter from a WordPress wp-content working directory, the durable behavioral signature of successful wp2shell exploitation regardless of entry vector.
Page 3 of 4