SC: Self-Healing WordPress Backdoor Mesh

Looks for: a web-server worker process writing .user.ini at runtime, the #1 persistence point (auto_prepend_file), cached by PHP for up to five minutes. FP: legitimate deploy pipelines touching .user.ini during a release window.

// HUNT: New or modified .user.ini setting auto_prepend_file
// MITRE: T1505.003
// CONF: high
// FP: low
// COST: low
// REQUIRES: CriticalFileModified (Falcon FIM / Critical File policy covering the web document root) -- ⚠ validate in tenant: .user.ini must be added to your Falcon File Integrity Monitoring path list, it is not covered by default
// FALSE POSITIVES: deploy pipelines (Composer/WP-CLI/CI runners) touching .user.ini during a scheduled release window
#event_simpleName=/CriticalFileModified/
| FileName=/^\.user\.ini$/i
| ContextBaseFileName=/^(php-fpm|php-fpm[0-9.]*|php|httpd|apache2|nginx)/i
| table([aid, ComputerName, FileName, FilePath, ContextBaseFileName, ContextProcessId, UserName, @timestamp])

Looks for: a dot-prefixed PHP file written anywhere under wp-content, not a WordPress core or plugin convention. FP: none expected.

// HUNT: Hidden dot-prefixed PHP loader appears under wp-content
// MITRE: T1564.001, T1505.003
// CONF: high
// FP: low
// COST: low
// REQUIRES: CriticalFileModified scoped to the web document root -- ⚠ validate in tenant
// FALSE POSITIVES: none expected -- dot-prefixed PHP is not a WordPress core/plugin naming convention
#event_simpleName=/CriticalFileModified/
| FilePath=/\/wp-content\//i
| FileName=/^\.[A-Za-z0-9_-]+\.php$/i
| table([aid, ComputerName, FileName, FilePath, ContextBaseFileName, ContextProcessId, UserName, @timestamp])

Looks for: the two earliest-loading WordPress drop-ins rewritten at runtime by the web worker itself, not by a deploy tool. FP: legitimate caching plugins (WP Super Cache, W3TC) write advanced-cache.php during their own activation/save-settings flow.

// HUNT: WordPress bootstrap drop-in (db.php / advanced-cache.php) rewritten by a running web-server process
// MITRE: T1505.003
// CONF: high
// FP: medium
// COST: low
// REQUIRES: CriticalFileModified scoped to wp-content -- ⚠ validate in tenant
// FALSE POSITIVES: caching-plugin activation or settings-save from within a logged-in admin's own wp-admin request
// TUNING: exclude writes whose ContextProcessId / timestamp correlates to an authenticated admin's own plugin-settings-save request in the WP audit log; escalate only when no matching admin action exists
#event_simpleName=/CriticalFileModified/
| FileName=/^(db|advanced-cache)\.php$/i
| FilePath=/\/wp-content\//i
| ContextBaseFileName=/^(php-fpm|php-fpm[0-9.]*|php|httpd|apache2|nginx)/i
| table([aid, ComputerName, FileName, FilePath, ContextBaseFileName, ContextProcessId, UserName, @timestamp])

Looks for: the theme-resident twin of the db.php drop-in: the SC_ bounded block appended to functions.php. FP: legitimate edits via the WordPress Theme Editor or a deploy pipeline are common and look identical at the file-write level.

// HUNT: Active theme functions.php rewritten by the web-server process at runtime
// MITRE: T1505.003
// CONF: medium
// FP: high
// COST: low
// REQUIRES: CriticalFileModified scoped to wp-content/themes -- ⚠ validate in tenant
// FALSE POSITIVES: legitimate theme edits via theme-editor.php, or a deploy pipeline pushing a theme update
// TUNING: exclude writes that occur within seconds of an authenticated administrator's own theme-editor.php POST (correlate aid + UserName + timestamp against the WP audit log); escalate only when no matching admin edit exists in the same window
#event_simpleName=/CriticalFileModified/
| FileName=/^functions\.php$/i
| FilePath=/\/wp-content\/themes\//i
| ContextBaseFileName=/^(php-fpm|php-fpm[0-9.]*|php|httpd|apache2|nginx)/i
| table([aid, ComputerName, FileName, FilePath, ContextBaseFileName, ContextProcessId, UserName, @timestamp])

Looks for: the must-use-plugin copy of the backdoor landing in mu-plugins, a directory that almost never changes outside a deliberate deploy. FP: a genuine mu-plugin deploy during a maintenance window.

// HUNT: New file written to wp-content/mu-plugins at runtime
// MITRE: T1505.003
// CONF: high
// FP: low
// COST: low
// REQUIRES: CriticalFileModified scoped to wp-content/mu-plugins -- ⚠ validate in tenant
// FALSE POSITIVES: a deliberate mu-plugin deploy during a maintenance window
#event_simpleName=/CriticalFileModified/
| FilePath=/\/wp-content\/mu-plugins\//i
| FileName=/\.php$/i
| table([aid, ComputerName, FileName, FilePath, ContextBaseFileName, ContextProcessId, UserName, @timestamp])

Looks for: the ZIP restore bundle the loader falls back to when its other sources are missing. FP: legitimate backup plugins and manual plugin/theme installs via wp-admin also write ZIPs here.

// HUNT: Randomly named ZIP archive written under wp-content/uploads or a theme folder
// MITRE: T1505.003, T1027
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: ZipFileWritten
// FALSE POSITIVES: legitimate backup plugins (e.g. UpdraftPlus) and manual plugin/theme installs via wp-admin
// TUNING: exclude ZIP writes whose ContextProcessId correlates to a logged-in admin's plugin-upload or backup-plugin request; prioritize purely-hex 8+ character basenames with no companion admin action
#event_simpleName=/ZipFileWritten/
| FilePath=/\/wp-content\/(uploads|themes)\//i
| FileName=/^[0-9a-f]{8,}\.zip$/i
| table([aid, ComputerName, FileName, FilePath, ContextBaseFileName, ContextProcessId, UserName, @timestamp])

Looks for: classic web-shell-style behavior: a web worker process has no legitimate reason to exec a shell. FP: rare plugin shell-out helpers (e.g., ImageMagick wrappers); baseline once.

// HUNT: PHP-FPM / httpd / nginx worker spawns an interactive shell
// MITRE: T1505.003, T1059.004
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2
// FALSE POSITIVES: a rare legitimate exec() from a plugin's own shell-out helper -- baseline your app's known child-process list once before promoting to an IOA
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(php-fpm|php-fpm[0-9.]*|php|httpd|apache2|nginx)/i
| FileName=/^(sh|bash|dash|zsh)$/i
| table([aid, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName, @timestamp])

Looks for: system cron invoking wp-cron.php, the mechanism SC abuses to re-trigger redeployment on schedule. FP: this is also the standard, recommended way to run WordPress cron on a hardened site: this query is a baseline-builder, not a detection by itself.

// HUNT: System cron triggers wp-cron.php (baseline for scheduled redeployment hooks)
// MITRE: T1053.003
// CONF: low
// FP: high
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: running wp-cron.php via system cron instead of WordPress's default pseudo-cron is a widely RECOMMENDED hardening practice -- it fires on every site that has adopted it
// TUNING: this query alone is not a detection -- it is a baseline-builder. Pair every hit with the native wp_options cron-array audit in Section 7 to surface randomized hook names system cron is unknowingly executing alongside the legitimate wp-cron.php invocation
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^cron(d)?$/i
| CommandLine=/wp-cron\.php/i
| table([aid, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName, @timestamp])

Looks for: the web worker shelling out to a MySQL CLI rather than using the normal PHP DB abstraction layer: a proxy for the "direct database connection bypassing WordPress APIs" Sucuri describes. FP: scheduled backup scripts that legitimately shell out to mysqldump.

// HUNT: Web-server worker spawns a MySQL client directly
// MITRE: T1505.003
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: scheduled backup jobs (e.g. "wp db export" via WP-CLI, cPanel backup jobs) that legitimately shell out to mysqldump
// TUNING: exclude known backup-job service accounts/cron wrappers; flag only when the parent is the LIVE PHP-FPM/httpd worker servicing an HTTP request, not a cron-invoked backup script
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(php-fpm|php-fpm[0-9.]*|php|httpd|apache2|nginx)/i
| FileName=/^(mysql|mysqldump)$/i
| table([aid, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName, @timestamp])

Looks for: the web worker reaching out to public Ethereum RPC gateways for C2 instructions. FP: nearly everything: CDNs, payment gateways, license/update checks. Triage only, never an automated block; never promote to prevent.

// HUNT: Web-server worker makes outbound HTTPS connections (blockchain RPC egress triage)
// MITRE: T1102.002, T1071.001
// CONF: low
// FP: high
// COST: medium
// REQUIRES: NetworkConnectIP4; a tenant-maintained public-RPC-provider watchlist for manual cross-reference
// FALSE POSITIVES: nearly everything -- CDNs, payment gateways, license/update checks, and every other legitimate third-party API the app calls over 443
// TUNING: REPLACE_WITH_RPC_WATCHLIST -- join RemoteAddressIP4 / resolved DomainName against your current public-Ethereum-RPC-provider watchlist before triaging; without that join this returns ordinary CDN/API noise. Detect/hunt only -- never action=prevent, this is shared legitimate third-party infrastructure
#event_simpleName=/NetworkConnectIP4/
| ContextBaseFileName=/^(php-fpm|php-fpm[0-9.]*|php|httpd|apache2|nginx)/i
| RemotePort=443
| table([aid, ComputerName, ContextBaseFileName, ContextProcessId, RemoteAddressIP4, RemotePort, LocalAddressIP4, @timestamp])

Looks for: DNS lookups from the web host matching a tenant-supplied RPC-provider watchlist pattern. FP: any benign site integrating wallet/crypto-payment features, browser extensions, or shared-hosting neighbors. Detect/hunt only.

// HUNT: DNS resolution from a web-server process to a public Ethereum RPC provider (watchlist match)
// MITRE: T1102.002
// CONF: low
// FP: high
// COST: low
// REQUIRES: DnsRequest; same tenant RPC watchlist as Q10
// FALSE POSITIVES: any benign site legitimately integrating wallet/crypto-payment features, browser extensions resolving the same public gateways, or shared-hosting neighbors
// TUNING: REPLACE_WITH_RPC_PROVIDER_DOMAIN_PATTERN -- populate with your current public RPC-provider domain watchlist before running. Detect/hunt only -- never block shared legitimate infrastructure
#event_simpleName=/DnsRequest/
| DomainName=/REPLACE_WITH_RPC_PROVIDER_DOMAIN_PATTERN/i
| table([aid, ComputerName, ContextProcessId, DomainName, QueryType, @timestamp])