Merge PR #6155 from @swachchhanda000 - Add WordPress Wp2shell Detections

new: WordPress Wp2shell REST Batch Endpoint Exploitation
new: WordPress Wp2shell Webshell Plugin Access
new: WordPress Wp2shell Exploitation Tool User-Agent

Author: swachchhanda000

rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_batch_rest_route_abuse.yml

@@ -0,0 +1,34 @@
+title: WordPress Wp2shell REST Batch Endpoint Exploitation
+id: b8d5f301-2c49-4e6d-af83-4a5b6c7d8e9f
+status: experimental
+description: |
+    Detects exploitation attempts against the WordPress REST batch endpoint (CVE-2026-63030,
+    CVE-2026-60137) using the wp2shell PoC tool. The tool sends POST requests to the batch endpoint
+    via the ?rest_route=/batch/v1 query parameter, covering all attack phases from initial probe
+    through SQL injection and pre-auth admin creation. A 207 response confirms the endpoint is
+    active on the target.
+references:
+    - https://github.com/Icex0/wp2shell-poc
+    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
+    - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2026-07-19
+tags:
+    - attack.initial-access
+    - attack.t1190
+    - detection.emerging-threats
+    - cve.2026-63030
+    - cve.2026-60137
+logsource:
+    category: webserver
+detection:
+    selection:
+        cs-method: 'POST'
+        sc-status: 207
+        cs-uri-query|contains:
+            - 'rest_route=/batch/v1'
+            - 'rest_route=%2Fbatch%2Fv1'
+    condition: selection
+falsepositives:
+    - WordPress CLI scripts or maintenance tooling invoking the batch endpoint via query parameter
+level: medium

rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_webshell_plugin_access.yml

@@ -0,0 +1,32 @@
+title: WordPress Wp2shell Webshell Plugin Access
+id: c9e6f412-3d50-4f7e-bf94-5b6c7d8e9f0a
+status: experimental
+description: |
+    Detects post-exploitation access to the wp2shell webshell plugin dropped after successful
+    exploitation of CVE-2026-63030 and CVE-2026-60137. After the pre-auth SQLi-to-admin bridge is established,
+    the attacker can upload a malicious plugin (wp2shell) to the target WordPress instance.
+    At this phase, the attacker accesses the webshell for command execution and persistence.
+references:
+    - https://github.com/Icex0/wp2shell-poc
+    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
+    - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2026-07-19
+tags:
+    - attack.execution
+    - attack.persistence
+    - attack.t1505.003
+    - cve.2026-63030
+    - cve.2026-60137
+    - detection.emerging-threats
+logsource:
+    category: webserver
+detection:
+    selection:
+        cs-uri-stem|contains: '/wp-content/plugins/wp2shell_'
+    filter_optional_null_query:
+        cs-uri-query: null
+    condition: selection and not 1 of filter_optional_*
+falsepositives:
+    - Unlikely
+level: critical

rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_wp2shell_tool_useragent.yml

@@ -0,0 +1,27 @@
+title: WordPress Wp2shell Exploitation Tool User-Agent
+id: a7c4e2f9-1b38-4d5c-9e72-3f4a5b6c7d8e
+status: experimental
+description: |
+    Detects the hardcoded "wp2shell" User-Agent string used by the wp2shell
+    PoC tool during all phases of CVE-2026-63030 and CVE-2026-60137 exploitation.
+references:
+    - https://github.com/Icex0/wp2shell-poc
+    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
+    - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2026-07-19
+tags:
+    - attack.initial-access
+    - attack.t1190
+    - cve.2026-63030
+    - cve.2026-60137
+    - detection.emerging-threats
+logsource:
+    category: webserver
+detection:
+    selection:
+        cs-user-agent: 'wp2shell'
+    condition: selection
+falsepositives:
+    - Unlikely
+level: high