WordPress-specific droppers

Backdoors that hide inside WordPress structures: PHP in uploads, fake wp-config includes, mu-plugins backdoors, fake plugin headers with curl/eval, appended eval in index.php.

Source file: panomity_wordpress_droppers.yar (license MIT, author Panomity GmbH). Scores range from 0 to 100; 85 and above marks a finding as malicious on its own, 40 to 84 as suspicious.

Rule	Score	What it detects
`Panomity_WP_Uploads_PHP_Dropper`	88	PHP file dropped into wp-content/uploads that writes another PHP payload
`Panomity_WP_Config_Fake_Include`	87	Fake wp-config style loader that includes and evaluates a hidden payload file
`Panomity_WP_MuPlugins_Backdoor`	90	mu-plugins auto-loaded backdoor combining add_action with dynamic code execution on request input
`Panomity_WP_Fake_Plugin_Header_Backdoor`	89	File carrying a WordPress plugin header while fetching and evaluating remote code
`Panomity_WP_Index_Appended_Eval`	86	WordPress bootstrap file with an appended eval loader over request input

Reporting a false positive

Send the finding ID, the rule name and, if possible, the file (or its SHA-256) to hallo@panomity.de or open a ticket in the client area . Confirmed false positives are fixed in the next signed generation; clients receive it automatically.