[[ fm.text ]] Click here

Web server or PHP process spawning shell after WordPress wp2shell RCE chain - Linux - STRICT

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown

Detects web server or PHP runtime processes on Linux spawning shells or common post-exploitation tools, consistent with command execution through the plugin webshell dropped after CVE-2026-63030 / CVE-2026-60137 (wp2shell) exploitation. Confirmation signal on a different surface than the web-layer rule, independent of WAF body-inspection depth. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity. Détecte un processus web ou PHP sous Linux qui lance un shell ou un outil de post-exploitation, cohérent avec l'exécution de commande via le webshell plugin déposé après exploitation de CVE-2026-63030 / CVE-2026-60137 (wp2shell). Signal de confirmation sur une couche différente de la règle web, utile quand le WAF n'inspecte pas le corps des requêtes POST. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.

title: Web server or PHP process spawning shell after WordPress wp2shell RCE chain - Linux - STRICT
id: 1142bb3f-7113-439d-a08f-435bddad23f6
status: experimental
description: |
  Detects web server or PHP runtime processes on Linux spawning shells or common post-exploitation tools, consistent with command execution through the plugin webshell dropped after CVE-2026-63030 / CVE-2026-60137 (wp2shell) exploitation. Confirmation signal on a different surface than the web-layer rule, independent of WAF body-inspection depth. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte un processus web ou PHP sous Linux qui lance un shell ou un outil de post-exploitation, cohérent avec l'exécution de commande via le webshell plugin déposé après exploitation de CVE-2026-63030 / CVE-2026-60137 (wp2shell). Signal de confirmation sur une couche différente de la règle web, utile quand le WAF n'inspecte pas le corps des requêtes POST. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
related:
  - id: 49c3984c-d57e-4d57-9fe0-676a949c8d47
    type: derived
  - id: fd7e84d0-7add-4438-8677-0ce7ed575def
    type: derived

references:
  - https://www.cve.org/CVERecord?id=CVE-2026-63030
  - https://www.cve.org/CVERecord?id=CVE-2026-60137
  - https://github.com/advisories/GHSA-ff9f-jf42-662q
  - https://github.com/Icex0/wp2shell-poc

author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-07-19

tags:
  - attack.execution
  - attack.t1059.004
  - attack.persistence
  - attack.t1505.003
  - attack.command-and-control
  - attack.t1105
  - cve.2026-63030
  - cve.2026-60137

logsource:
  product: linux
  category: process_creation
  definition: >
    Linux process creation telemetry from auditd, Sysmon for Linux or EDR. Required fields:
    Image, CommandLine, ParentImage, ParentCommandLine, CurrentDirectory, User.

detection:
  selection_web_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/apache2-prefork'
      - '/apache2-worker'
      - '/httpd'
      - '/httpd.worker'
      - '/httpd.event'
      - '/nginx'
      - '/php'
      - '/php-cgi'
      - '/lsphp'

  selection_php_fpm_parent_image:
    ParentImage|contains:
      - '/php-fpm'
      - '/php7.'
      - '/php8.'
      - '/php-cgi'
      - '/lsphp'

  selection_php_fpm_parent_cmd:
    ParentCommandLine|contains:
      - 'php-fpm'
      - 'php-cgi'
      - 'lsphp'
      - 'pool www'

  selection_web_user:
    User|contains:
      - 'www-data'
      - 'apache'
      - 'nginx'
      - 'httpd'
      - 'nobody'

  selection_shell_or_tool:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/id'
      - '/whoami'
      - '/uname'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/socat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/busybox'
      - '/base64'
      - '/chmod'

  selection_suspicious_cli:
    CommandLine|contains:
      - 'bash -c'
      - 'sh -c'
      - 'curl '
      - 'wget '
      - 'nc -'
      - 'ncat '
      - 'python -c'
      - 'python3 -c'
      - 'perl -e'
      - '/dev/tcp/'
      - '0>&1'
      - '2>&1'
      - 'mkfifo'
      - 'base64 -d'
      - 'base64 --decode'
      - 'chmod +x'

  # Contextual reinforcement: the wp2shell plugin webshell executes shell_exec() from a
  # PHP file under a plugin directory generated by the exploit, so the interpreter's
  # working directory or the parent command line often carries a WordPress path segment.
  selection_wordpress_context:
    CurrentDirectory|contains:
      - '/wp-content/'
      - '/wp-admin/'
      - '/wp-includes/'

  # AM-FIX (2026-08-07 red team pass): every branch above requires either a named LOLBin
  # (selection_shell_or_tool) or a keyword match in CommandLine (selection_suspicious_cli). A
  # custom-named payload dropped under wp-content/uploads (the classic WordPress webshell drop
  # location) and executed with no shell metacharacters or listed keywords in its own argv,
  # e.g. "/var/www/html/wp-content/uploads/2026/08/.cache/x1 --daemon", matched none of the
  # existing selections and was a complete miss. Consistent with the same class of gap found
  # and fixed today in the Langflow, Tomcat, Rails and Veeam packs.
  selection_child_suspicious_path:
    Image|contains:
      - '/wp-content/uploads/'
      - '/wp-content/plugins/'
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'

  filter_legitimate_maintenance:
    CommandLine|contains:
      - 'logrotate'
      - 'certbot'
      - 'apachectl'
      - 'nginx -t'
      - 'php-fpm -t'
      - 'service php'
      - 'systemctl reload'
      - 'wp-cron.php'

  condition: >
    (((selection_web_parent or selection_php_fpm_parent_image or selection_php_fpm_parent_cmd) and
      (selection_shell_or_tool or selection_suspicious_cli or selection_child_suspicious_path)) or
     (selection_web_user and (selection_suspicious_cli or selection_child_suspicious_path)) or
     (selection_web_user and selection_shell_or_tool and selection_wordpress_context)) and
    not filter_legitimate_maintenance

fields:
  - Computer
  - User
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - CurrentDirectory
  - ProcessId
  - ParentProcessId

falsepositives:
  - Hosting control panels or maintenance jobs invoked through web administration interfaces
  - Legitimate WordPress plugins or themes that intentionally shell out to system utilities (rare, validate against known baselines)
  - Backup or staging tools that spawn shell commands from a PHP-FPM worker

level: critical

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f8890b84-f85e-4ffe-a21f-b0542bb6d9b4

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion