sublimemediumRule

Link: Suspicious wp-admin path from mismatched sender domain

Detects inbound messages containing links to a WordPress /wp-admin/ path where the link domain does not match the sender's domain. Matches two patterns: a single directory under /wp-admin/ with no file extension, or a .php payload nested at least one subdirectory below /wp-admin/ (e.g. /wp-admin/foo/bar.php). Both are indicative of compromised WordPress sites being repurposed to host phishing pages; legitimate WP notification paths like/wp-admin/admin.php are excluded by the subdirectory requirement.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
// either a single dir under /wp-admin/ with no file extension or a .php payload nested at least one subdirectory below /wp-admin/
and any(body.links,
        regex.icontains(.href_url.path,
                        '^/wp-admin/[^/\.]+/?$',
                        '/wp-admin/[^/]+/[^/]+\.php$'
        )
        // domain is not the same as the sender domain
        and .href_url.domain.root_domain != sender.email.domain.root_domain
)
and not (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    // website security companies that send reports via email
    or sender.email.domain.root_domain in ('imperva.com', 'urllo.com')
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Suspicious wp-admin path from mismatched sender domain"
description: "Detects inbound messages containing links to a WordPress /wp-admin/ path where the link domain does not match the sender's domain. Matches two patterns: a single directory under /wp-admin/ with no file extension, or a .php payload nested at least one subdirectory below /wp-admin/ (e.g. /wp-admin/foo/bar.php). Both are indicative of compromised WordPress sites being repurposed to host phishing pages; legitimate WP notification paths like/wp-admin/admin.php are excluded by the subdirectory requirement."
type: "rule"
severity: "medium"
source: |
  type.inbound
  // either a single dir under /wp-admin/ with no file extension or a .php payload nested at least one subdirectory below /wp-admin/
  and any(body.links,
          regex.icontains(.href_url.path,
                          '^/wp-admin/[^/\.]+/?$',
                          '/wp-admin/[^/]+/[^/]+\.php$'
          )
          // domain is not the same as the sender domain
          and .href_url.domain.root_domain != sender.email.domain.root_domain
  )
  and not (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      // website security companies that send reports via email
      or sender.email.domain.root_domain in ('imperva.com', 'urllo.com')
    )
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
  
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
  - "Spoofing"
detection_methods:
  - "URL analysis"
  - "Sender analysis"
  - "Header analysis"
id: "e8fa7870-b771-5dcd-b5f3-59f866ba00e2"