IIS or PHP on Windows spawning command shell after WordPress wp2shell RCE chain - STRICT
SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown
Detects IIS, PHP-CGI or PHP runtime processes on Windows spawning command shells or common post-exploitation tools, consistent with command execution through the plugin webshell dropped after CVE-2026-63030 / CVE-2026-60137 (wp2shell) exploitation on Windows/IIS-hosted WordPress. Confirmation signal on a different surface than the web-layer rule. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Détecte IIS, php-cgi.exe ou php.exe lançant cmd.exe, PowerShell ou des outils de post-exploitation sur Windows, cohérent avec l'exécution de commande via le webshell plugin déposé après exploitation de CVE-2026-63030 / CVE-2026-60137 (wp2shell) sur un WordPress hébergé sous Windows/IIS. Couvre l'angle mort des hébergements Windows non couvert par la règle Linux. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
title: IIS or PHP on Windows spawning command shell after WordPress wp2shell RCE chain - STRICT
id: fd7e84d0-7add-4438-8677-0ce7ed575def
status: experimental
description: |
Detects IIS, PHP-CGI or PHP runtime processes on Windows spawning command shells or common post-exploitation tools, consistent with command execution through the plugin webshell dropped after CVE-2026-63030 / CVE-2026-60137 (wp2shell) exploitation on Windows/IIS-hosted WordPress. Confirmation signal on a different surface than the web-layer rule. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Détecte IIS, php-cgi.exe ou php.exe lançant cmd.exe, PowerShell ou des outils de post-exploitation sur Windows, cohérent avec l'exécution de commande via le webshell plugin déposé après exploitation de CVE-2026-63030 / CVE-2026-60137 (wp2shell) sur un WordPress hébergé sous Windows/IIS. Couvre l'angle mort des hébergements Windows non couvert par la règle Linux. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
related:
- id: 49c3984c-d57e-4d57-9fe0-676a949c8d47
type: derived
- id: 1142bb3f-7113-439d-a08f-435bddad23f6
type: derived
references:
- https://www.cve.org/CVERecord?id=CVE-2026-63030
- https://www.cve.org/CVERecord?id=CVE-2026-60137
- https://github.com/advisories/GHSA-ff9f-jf42-662q
- https://github.com/Icex0/wp2shell-poc
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-07-19
tags:
- attack.execution
- attack.t1059.001
- attack.t1059.003
- attack.persistence
- attack.t1505.003
- attack.command-and-control
- attack.t1105
- cve.2026-63030
- cve.2026-60137
logsource:
product: windows
category: process_creation
definition: >
Windows process creation telemetry from Sysmon Event ID 1, EDR, or Security 4688 with
command line capture. Required fields: Image, CommandLine, ParentImage, ParentCommandLine.
detection:
selection_web_parent:
ParentImage|endswith:
- '\w3wp.exe'
- '\php-cgi.exe'
- '\php.exe'
- '\httpd.exe'
- '\nginx.exe'
selection_php_parent_cmd:
ParentCommandLine|contains:
- 'php-cgi.exe'
- 'php.exe'
- 'wp-content'
- 'wp-admin'
- 'index.php'
selection_child_shell_or_tool:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\curl.exe'
- '\wget.exe'
- '\nc.exe'
- '\ncat.exe'
- '\whoami.exe'
- '\ipconfig.exe'
- '\net.exe'
- '\net1.exe'
selection_suspicious_cli:
CommandLine|contains:
- ' /c '
- ' -enc '
- ' -EncodedCommand '
- 'IEX '
- 'Invoke-WebRequest'
- 'iwr '
- 'curl '
- 'certutil -urlcache'
- 'bitsadmin /transfer'
- 'FromBase64String'
- 'DownloadString'
- 'whoami'
- 'ipconfig'
# AM-FIX (2026-08-07 red team pass): both selections above require either a named LOLBin or a
# keyword match in CommandLine. A custom-named payload dropped under wp-content\uploads or a
# user-writable temp directory and launched with no shell metacharacters or listed keywords
# in its own argv was a complete miss. Consistent with the same class of gap found and fixed
# today in the Langflow, Tomcat, Rails, Veeam and Linux wp2shell packs.
selection_child_suspicious_path:
Image|contains:
- '\wp-content\uploads\'
- '\wp-content\plugins\'
- '\Windows\Temp\'
- '\AppData\Local\Temp\'
- '\Users\Public\'
filter_legitimate_iis_admin:
CommandLine|contains:
- 'appcmd.exe'
- 'iisreset'
- 'php -v'
- 'php-cgi.exe -v'
- 'wp-cron.php'
condition: >
(selection_web_parent or selection_php_parent_cmd) and
(selection_child_shell_or_tool or selection_suspicious_cli or selection_child_suspicious_path) and
not filter_legitimate_iis_admin
fields:
- Computer
- User
- Image
- CommandLine
- ParentImage
- ParentCommandLine
- CurrentDirectory
- ProcessId
- ParentProcessId
falsepositives:
- Hosting control panel tasks launched through IIS/PHP administration interfaces
- Legitimate PHP applications invoking system utilities, tune by known application paths and service accounts
- Authorized red team testing
level: critical