Plan
archived
WordPress 'SC' Backdoor Uses Files, DB, and Shared Memory to Persist
- Engineer — Plan: WordPress is pervasive in enterprise estates and this multi-vector persistence (filesystem + database + shared memory segments) means standard file-only cleanup leaves the site re-infected; audit WordPress deployments for SC_ markers in files and the database, and inspect PHP shared memory usage via shmop-based process inspection.
- SOC/IR — Plan: The shared-memory component creates a blind spot for file-integrity and AV-based scans; build or tune detections for PHP processes writing to shared memory segments (shmop_open/write syscalls) and add a correlation rule requiring simultaneous sweep of filesystem, database content, and memory when a WordPress compromise is suspected.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.