Phoenix
Sigma IntelligenceBeta

Search rules

Search the full rule library from any page.

    Phoenix Studio

    Convert indexed Sigma rules into analyst-ready detections.

    This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a local pySigma backend, then reveal pipelines only when you actually need them.

    Browse RulesExplore Ecosystem

    Indexed Rules

    3,779

    Ready to search

    Backends

    3

    Loaded from pysigma-node

    pySigma Versions

    2

    Newest: 2.0.1

    Translation Workspace

    Shape the rule before it leaves Phoenix

    Tune Translation

    Active Rule

    WordPress Wp2shell Exploitation Tool User-Agent

    Backends follow their supported pySigma version. Select 1.5.1 for Elasticsearch, Kusto, and other 1.x plugins.

    Target Profile

    Splunk

    Splunk through pysigma-backend-splunk.

    Format Mode

    Default

    Default pySigma output mode for this backend.

    Conversion Output

    WordPress Wp2shell Exploitation Tool User-Agent

    Using Splunk · Default · pySigma 2.0.1

    Translation controls

    Adjust the rule on the left, then regenerate when you want a fresh backend-native query.

    BackendSplunkFormatDefaultVersion2.0.1
    title: WordPress Wp2shell Exploitation Tool User-Agent
id: a7c4e2f9-1b38-4d5c-9e72-3f4a5b6c7d8e
status: experimental
description: |
    Detects the hardcoded "wp2shell" User-Agent string used by the wp2shell
    PoC tool during all phases of CVE-2026-63030 and CVE-2026-60137 exploitation.
references:
    - https://github.com/Icex0/wp2shell-poc
    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
    - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-07-19
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026-63030
    - cve.2026-60137
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-user-agent: 'wp2shell'
    condition: selection
falsepositives:
    - Unlikely
level: high

    CLI command

    Sigma CLI 4.0.0 · Install matching versions, then run from the Phoenix project directory.

    python -m pip install 'sigma-cli==4.0.0' 'pysigma==2.0.1' 'pysigma-backend-splunk==3.0.0' sigma convert --without-pipeline -t splunk -f default 'sigma/rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_wp2shell_tool_useragent.yml'