Awesome Motive CDN Supply-Chain Attack — OptinMonster / TrustPulse / PushEngage Tampered CDN Scripts

Looks for: any DNS request for tidio.cc or a tidio* lookalike that is not the legitimate tidio.com. Accomplishes: the single highest-fidelity signal in the pack — near-zero benign baseline.

// HUNT: DNS lookups for tidio.cc C2 / non-tidio.com typosquat family
// MITRE: T1071.001, T1567 | CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest telemetry from web servers and admin workstations
// FALSE POSITIVES: legitimate tidio.com chat widget (explicitly excluded below)
// TUNING: keep tidio.com (and its real CDN subdomains) on the allow-list; alert on all other tidio*
#event_simpleName=/DnsRequest/i
| DomainName=/(^|\.)tidio/i
| DomainName!=/(^|\.)tidio\.com$/i
| table([@timestamp, aid, ComputerName, DomainName, RequestType], limit=200)
| sort(@timestamp, order=desc)

Looks for: outbound connections on web ports made by a PHP / web-server worker process — abnormal for a web server, and the path the backdoor uses to beacon/exfil. Accomplishes: catches the exfil even if DNS is cached or hard-coded to an IP.

// HUNT: Web-server worker process making outbound web connections (backdoor beacon / exfil)
// MITRE: T1071.001, T1567 | CONF: high  FP: low  COST: medium
// REQUIRES: NetworkConnectIP4 with initiating-process context
// FALSE POSITIVES: legitimate plugin update/license checks, REST calls to known APIs
// TUNING: allow-list sanctioned outbound endpoints (plugin update servers, payment gateways)
#event_simpleName=/NetworkConnectIP4/i
| ContextBaseFileName=/^(php|php-fpm[0-9.]*|httpd|apache2|nginx|w3wp)(\.exe)?$/i
| in(RemotePort, values=[80, 443, 8080, 8443])
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)/
| table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)
| sort(@timestamp, order=desc)

Looks for: the rogue-admin identifiers (developer_api1, customer1usx@gmail.com, dev_*) appearing in process command lines — e.g. a wp-cli user create, a DB client, or a script touching the account. FP: legitimate dev-named accounts — review hits. Pair with Native N4 (the authoritative roster check is in the WP DB).

// HUNT: Rogue WP admin identifiers (developer_api1 / customer1usx / dev_*) in process args
// MITRE: T1136 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 command-line telemetry on web servers
// FALSE POSITIVES: legitimate developer accounts using a dev_ naming convention
// TUNING: confirm against the WP DB (N4); allow-list known-good dev_ accounts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/i
| CommandLine=/(developer_api1|customer1usx@gmail\.com|user\s+create\s+dev_[a-z0-9]+|INSERT.+wp_users)/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: files being written under the backdoor plugin directories content-delivery-helper / database-optimizer, or any new .php written under wp-content/plugins/ by a web-server worker. Accomplishes: catches the on-disk backdoor drop at the moment of install.

// HUNT: New backdoor plugin files written under wp-content/plugins (Content Delivery Helper / Database Optimizer)
// MITRE: T1505.003 | CONF: high  FP: low  COST: low
// REQUIRES: FileCreateInfo / PeFileWritten with writing-process context
// FALSE POSITIVES: legitimate plugin installs/updates from the WP admin UI
// TUNING: alert on the two named dirs first; for the generic .php rule, allow-list scheduled update windows
#event_simpleName=/PeFileWritten/i
| TargetFileName=/wp-content[\/\\]plugins[\/\\](content-delivery-helper|database-optimizer)[\/\\]/i
| table([@timestamp, aid, ComputerName, ContextBaseFileName, TargetFileName, UserName], limit=200)
| sort(@timestamp, order=desc)

Looks for: DNS resolution of the affected vendors' CDN domains from admin workstations during the payload window — the exposure surface for the browser-side execution. FP: normal plugin usage — scope to the 2026-06-12 → 2026-06-14 window and pivot exposed admins to N4. ⚠ vendor CDN host names vary — confirm against your traffic

// HUNT: Admin workstation resolving affected-vendor CDN domains (browser-side exposure window)
// MITRE: T1195.002, T1059.007 | CONF: medium  FP: medium  COST: low
// REQUIRES: DnsRequest telemetry from WordPress admin workstations
// FALSE POSITIVES: routine plugin usage outside the payload window
// TUNING: constrain to 2026-06-12..2026-06-14; treat resolving admins as exposed, pivot to N4
#event_simpleName=/DnsRequest/i
| DomainName=/(optinmonster|trustpulse|pushengage|awesomemotive)/i
| @timestamp>=1749686400000
| @timestamp<=1749945600000
| table([@timestamp, aid, ComputerName, DomainName], limit=200)
| sort(@timestamp, order=desc)

Looks for: a PHP / web-server worker spawning a command shell or scripting interpreter — the canonical web-shell / backdoor-plugin hands-on-keyboard fingerprint. Accomplishes: detects post-compromise use of the planted backdoor independent of the C2 domain.

// HUNT: Web-server worker spawning a shell / interpreter (web-shell / backdoor-plugin activity)
// MITRE: T1505.003 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with parent-process context
// FALSE POSITIVES: rare legitimate exec() in plugins (image processing, cron) — allow-list by host/path
// TUNING: allow-list known plugin helper binaries; alert on bash/sh/powershell/cmd children of web workers
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/i
| ParentBaseFileName=/^(php|php-fpm[0-9.]*|httpd|apache2|nginx|w3wp)(\.exe)?$/i
| FileName=/^(bash|sh|dash|ksh|zsh|cmd|powershell|pwsh|wget|curl|python[0-9.]*)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)