[[ fm.text ]] Click here

Web server or PHP process spawning shell after WordPress XSS2Shell RCE chain - STRICT

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown

Detects web server or PHP runtime processes, on Linux or Windows/IIS, spawning shells or common post-exploitation tools, consistent with command execution through a malicious plugin webshell dropped after the CVE-2026-64638 (XSS2Shell) chain reaches its final stage: an authenticated Application Password, stolen via the login-page XSS and a Same Origin Method Execution (SOME) pivot, used to upload a plugin ZIP whose PHP files land directly under wp-content/plugins/ and are executable without activation. Confirmation signal on a different surface than the web-layer rules, independent of whether the log pipeline captures RequestBody on wp-login.php or the Application Password authorization flow. This rule merges what were previously two OS-specific STRICT rules (Linux and Windows/IIS) into a single cross-platform process_creation rule: the hosting platform does not change the nature of this confirmation signal, and Sigma's process_creation field vocabulary (Image, CommandLine, ParentImage, ParentCommandLine, User) is shared across both OS ecosystems. The suspicious-path check covers the entire wp-content/wp-content\ tree, not only plugins/uploads, so a renamed binary dropped under mu-plugins, a theme directory or a caching plugin's cache directory is not missed on filename alone. The maintenance/admin exemption is voided whenever a maintenance keyword (e.g. "wp-cron.php") co-occurs with a shell-chaining or obfuscation metacharacter, closing a decoy-keyword bypass where an attacker pads a malicious command with an innocuous maintenance substring purely to suppress the alert. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity. Détecte un processus web ou PHP, sous Linux ou Windows/IIS, qui lance un shell ou un outil de post-exploitation, cohérent avec l'exécution de commande via le webshell plugin déposé au terme de la chaîne CVE-2026-64638 (XSS2Shell) : un Application Password authentifié, volé via le XSS de la page de login et un pivot SOME (Same Origin Method Execution), est utilisé pour uploader un plugin ZIP dont les fichiers PHP atterrissent directement sous wp-content/plugins/ et sont exécutables sans activation. Signal de confirmation sur une couche différente des règles web, utile que le pipeline de logs capture ou non le corps de requête sur wp-login.php ou le flux d'autorisation d'Application Password. Cette règle fusionne deux anciennes règles STRICT spécifiques à un OS (Linux et Windows/IIS) en une seule règle process_creation cross-plateforme, sur demande explicite de l'utilisateur visant à réduire le nombre de règles du pack de 6 à 4 : la plateforme d'hébergement ne change pas la nature de ce signal de confirmation, et le vocabulaire de champs Sigma pour process_creation (Image, CommandLine, ParentImage, ParentCommandLine, User) est partagé entre les deux écosystèmes OS. Ce pattern cross-plateforme sans champ product existe déjà ailleurs dans ce dépôt (ex : CVE-2026-41089_Windows_Netlogon_RCE/rules/proc_creation_netlogon_cldap_poc_tooling_cve_2026_41089_broad.yml). La vérification de chemin suspect couvre tout l'arbre wp-content/wp-content\, pas seulement plugins/uploads, pour ne pas manquer un binaire renommé déposé sous mu-plugins, un thème ou le répertoire cache d'un plugin de cache. L'exemption de maintenance/administration est invalidée dès qu'un mot-clé de maintenance (par exemple "wp-cron.php") coexiste avec un métacaractère de chaînage ou d'obfuscation, fermant un contournement par mot-clé leurre où un attaquant remplit une commande malveillante d'une sous-chaîne de maintenance anodine dans le seul but de supprimer l'alerte. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.

title: Web server or PHP process spawning shell after WordPress XSS2Shell RCE chain - STRICT
id: 1cb448aa-2092-4d01-9509-5f723226e3a9
status: experimental
description: |
  Detects web server or PHP runtime processes, on Linux or Windows/IIS, spawning shells or common post-exploitation tools, consistent with command execution through a malicious plugin webshell dropped after the CVE-2026-64638 (XSS2Shell) chain reaches its final stage: an authenticated Application Password, stolen via the login-page XSS and a Same Origin Method Execution (SOME) pivot, used to upload a plugin ZIP whose PHP files land directly under wp-content/plugins/ and are executable without activation. Confirmation signal on a different surface than the web-layer rules, independent of whether the log pipeline captures RequestBody on wp-login.php or the Application Password authorization flow. This rule merges what were previously two OS-specific STRICT rules (Linux and Windows/IIS) into a single cross-platform process_creation rule: the hosting platform does not change the nature of this confirmation signal, and Sigma's process_creation field vocabulary (Image, CommandLine, ParentImage, ParentCommandLine, User) is shared across both OS ecosystems. The suspicious-path check covers the entire wp-content/wp-content\ tree, not only plugins/uploads, so a renamed binary dropped under mu-plugins, a theme directory or a caching plugin's cache directory is not missed on filename alone. The maintenance/admin exemption is voided whenever a maintenance keyword (e.g. "wp-cron.php") co-occurs with a shell-chaining or obfuscation metacharacter, closing a decoy-keyword bypass where an attacker pads a malicious command with an innocuous maintenance substring purely to suppress the alert. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte un processus web ou PHP, sous Linux ou Windows/IIS, qui lance un shell ou un outil de post-exploitation, cohérent avec l'exécution de commande via le webshell plugin déposé au terme de la chaîne CVE-2026-64638 (XSS2Shell) : un Application Password authentifié, volé via le XSS de la page de login et un pivot SOME (Same Origin Method Execution), est utilisé pour uploader un plugin ZIP dont les fichiers PHP atterrissent directement sous wp-content/plugins/ et sont exécutables sans activation. Signal de confirmation sur une couche différente des règles web, utile que le pipeline de logs capture ou non le corps de requête sur wp-login.php ou le flux d'autorisation d'Application Password. Cette règle fusionne deux anciennes règles STRICT spécifiques à un OS (Linux et Windows/IIS) en une seule règle process_creation cross-plateforme, sur demande explicite de l'utilisateur visant à réduire le nombre de règles du pack de 6 à 4 : la plateforme d'hébergement ne change pas la nature de ce signal de confirmation, et le vocabulaire de champs Sigma pour process_creation (Image, CommandLine, ParentImage, ParentCommandLine, User) est partagé entre les deux écosystèmes OS. Ce pattern cross-plateforme sans champ product existe déjà ailleurs dans ce dépôt (ex : CVE-2026-41089_Windows_Netlogon_RCE/rules/proc_creation_netlogon_cldap_poc_tooling_cve_2026_41089_broad.yml). La vérification de chemin suspect couvre tout l'arbre wp-content/wp-content\, pas seulement plugins/uploads, pour ne pas manquer un binaire renommé déposé sous mu-plugins, un thème ou le répertoire cache d'un plugin de cache. L'exemption de maintenance/administration est invalidée dès qu'un mot-clé de maintenance (par exemple "wp-cron.php") coexiste avec un métacaractère de chaînage ou d'obfuscation, fermant un contournement par mot-clé leurre où un attaquant remplit une commande malveillante d'une sous-chaîne de maintenance anodine dans le seul but de supprimer l'alerte. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
related:
  - id: 9f2ae8e2-13cc-408c-ae91-8c26fd5f13f5
    type: derived
  - id: 6651aeef-a7f9-4aed-95bb-370fbe7da24d
    type: derived
  - id: 4fc16c50-0ed6-42df-be58-7dd73bedcece
    type: derived

references:
  - https://www.cve.org/CVERecord?id=CVE-2026-64638
  - https://nvd.nist.gov/vuln/detail/CVE-2026-64638
  - https://wordpress.org/news/2026/08/wordpress-7-0-3-release/
  - https://hadrian.io/blog/wordpress-xss2shell-unauthenticated-login-screen-xss-to-php-code-execution-cve-2026-64638
  - https://pwn.ai/blog/xss2shell
  - https://github.com/imbas007/CVE-2026-64638-POC
  - https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-

author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-08-08
modified: 2026-08-14

tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1059.001
  - attack.t1059.003
  - attack.persistence
  - attack.t1505.003
  - attack.command-and-control
  - attack.t1105
  - cve.2026-64638

logsource:
  category: process_creation
  definition: >
    Process creation telemetry from Linux (auditd, Sysmon for Linux, EDR) or Windows (Sysmon
    Event ID 1, Security 4688, EDR) with command line capture. Required fields: Image,
    CommandLine, ParentImage, ParentCommandLine, CurrentDirectory, User.

detection:
  # Web server / PHP binary as direct parent - combined Linux and Windows/IIS process names.
  selection_web_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/apache2-prefork'
      - '/apache2-worker'
      - '/httpd'
      - '/httpd.worker'
      - '/httpd.event'
      - '/nginx'
      - '/php'
      - '/php-cgi'
      - '/lsphp'
      - '\w3wp.exe'
      - '\php-cgi.exe'
      - '\php.exe'
      - '\httpd.exe'
      - '\nginx.exe'

  # Linux-specific: PHP-FPM pool worker identified by ParentImage rather than ParentCommandLine.
  selection_php_fpm_parent_image:
    ParentImage|contains:
      - '/php-fpm'
      - '/php7.'
      - '/php8.'
      - '/php-cgi'
      - '/lsphp'

  # PHP-FPM / PHP-CGI parent identified by ParentCommandLine - combined Linux and Windows.
  selection_php_parent_cmdline:
    ParentCommandLine|contains:
      - 'php-fpm'
      - 'php-cgi'
      - 'lsphp'
      - 'pool www'
      - 'php-cgi.exe'
      - 'php.exe'
      - 'wp-content'
      - 'wp-admin'
      - 'index.php'

  # Linux-specific: web server service account, no direct Windows/IIS equivalent (IIS worker
  # processes run under ApplicationPoolIdentity, not matched via a User substring the same way).
  selection_web_user:
    User|contains:
      - 'www-data'
      - 'apache'
      - 'nginx'
      - 'httpd'
      - 'nobody'

  # Shell interpreters and common post-exploitation tools - combined Linux and Windows binaries.
  selection_shell_or_tool:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/id'
      - '/whoami'
      - '/uname'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/socat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/busybox'
      - '/base64'
      - '/chmod'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\nc.exe'
      - '\ncat.exe'
      - '\whoami.exe'
      - '\ipconfig.exe'
      - '\net.exe'
      - '\net1.exe'

  # Suspicious command-line patterns - combined Linux and Windows chaining/download/obfuscation indicators.
  selection_suspicious_cli:
    CommandLine|contains:
      - 'bash -c'
      - 'sh -c'
      - 'curl '
      - 'wget '
      - 'nc -'
      - 'ncat '
      - 'python -c'
      - 'python3 -c'
      - 'perl -e'
      - '/dev/tcp/'
      - '0>&1'
      - '2>&1'
      - 'mkfifo'
      - 'base64 -d'
      - 'base64 --decode'
      - 'chmod +x'
      - ' /c '
      - ' -enc '
      - ' -EncodedCommand '
      - 'IEX '
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'certutil -urlcache'
      - 'bitsadmin /transfer'
      - 'FromBase64String'
      - 'DownloadString'
      - 'whoami'
      - 'ipconfig'

  # WordPress working directory context - both path separator styles.
  selection_wordpress_context:
    CurrentDirectory|contains:
      - '/wp-content/'
      - '/wp-admin/'
      - '/wp-includes/'
      - '\wp-content\'
      - '\wp-admin\'
      - '\wp-includes\'

  # A freshly uploaded plugin webshell is typically launched with a custom, non-listed filename
  # and no shell metacharacters in its own argv, matching neither selection_shell_or_tool nor
  # selection_suspicious_cli. Catch it via its drop path instead - widened to the whole
  # wp-content tree on both platforms, not only plugins/uploads, since a renamed binary dropped
  # anywhere else under wp-content (mu-plugins, a theme directory, a caching plugin's cache
  # directory) previously evaded both this path check and the narrow filename list.
  selection_child_suspicious_path:
    Image|contains:
      - '/wp-content/'
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
      - '\wp-content\'
      - '\Windows\Temp\'
      - '\AppData\Local\Temp\'
      - '\Users\Public\'

  # Combined Linux maintenance and Windows/IIS admin keywords.
  filter_legitimate_maintenance:
    CommandLine|contains:
      - 'logrotate'
      - 'certbot'
      - 'apachectl'
      - 'nginx -t'
      - 'php-fpm -t'
      - 'service php'
      - 'systemctl reload'
      - 'wp-cron.php'
      - 'appcmd.exe'
      - 'iisreset'
      - 'php -v'
      - 'php-cgi.exe -v'

  # filter_legitimate_maintenance matches on a bare substring anywhere in CommandLine, so an
  # attacker can pad a malicious command with a decoy keyword (e.g. a trailing comment
  # containing "wp-cron.php") to suppress the alert while the actually-executed command is
  # unrelated. These two blocks void the exemption whenever a maintenance/admin keyword
  # co-occurs with a shell-chaining or obfuscation metacharacter that no simple maintenance
  # invocation would ever legitimately contain.
  selection_maintenance_keyword_present:
    CommandLine|contains:
      - 'logrotate'
      - 'certbot'
      - 'apachectl'
      - 'nginx -t'
      - 'php-fpm -t'
      - 'service php'
      - 'systemctl reload'
      - 'wp-cron.php'
      - 'appcmd.exe'
      - 'iisreset'
      - 'php -v'
      - 'php-cgi.exe -v'

  selection_chaining_metacharacters_present:
    CommandLine|contains:
      - '|'
      - ';'
      - '&'
      - '&&'
      - '||'
      - '$('
      - '`'
      - '0>&1'
      - '2>&1'
      - '/dev/tcp/'
      - 'base64'
      - 'IEX '
      - 'FromBase64String'
      - 'DownloadString'

  condition: >
    (((selection_web_parent or selection_php_fpm_parent_image or selection_php_parent_cmdline) and
      (selection_shell_or_tool or selection_suspicious_cli or selection_child_suspicious_path)) or
     (selection_web_user and (selection_suspicious_cli or selection_child_suspicious_path)) or
     (selection_web_user and selection_shell_or_tool and selection_wordpress_context)) and
    (not filter_legitimate_maintenance or
     (selection_maintenance_keyword_present and selection_chaining_metacharacters_present))

fields:
  - Computer
  - User
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - CurrentDirectory
  - ProcessId
  - ParentProcessId

falsepositives:
  - Hosting control panels or maintenance jobs invoked through web administration interfaces
  - Legitimate WordPress plugins or themes that intentionally shell out to system utilities (rare, validate against known baselines)
  - Backup or staging tools that spawn shell commands from a PHP-FPM worker or IIS/PHP administration interface
  - Authorized red team testing

level: critical

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

80d39219-d5f1-45f9-828c-7bfbaa989edc

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion