huntrule

Webserver User-Agent: wp2shell indicates wp2shell PoC activity

Alerts on web requests with User-Agent exactly equal to "wp2shell", matching wp2shell PoC behavior.

FreeUnreviewedSigmahighv1
title: "Webserver User-Agent: wp2shell indicates wp2shell PoC activity"
id: 9a6d45a4-1721-4f0c-8006-260eda807644
status: experimental
description: This rule flags webserver HTTP requests where the User-Agent header is exactly set to "wp2shell". Attackers using the wp2shell proof-of-concept tool rely on this hardcoded identifier during exploitation activity. Detection depends on HTTP request telemetry that includes User-Agent values from the webserver logs.
references:
  - https://github.com/Icex0/wp2shell-poc
  - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
  - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_wp2shell_tool_useragent.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-07-19
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2026-63030
  - cve.2026-60137
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-user-agent: wp2shell
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: a7c4e2f9-1b38-4d5c-9e72-3f4a5b6c7d8e
    type: derived

What it detects

This rule flags webserver HTTP requests where the User-Agent header is exactly set to "wp2shell". Attackers using the wp2shell proof-of-concept tool rely on this hardcoded identifier during exploitation activity. Detection depends on HTTP request telemetry that includes User-Agent values from the webserver logs.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.