WordPress-specific droppers
Backdoors that hide inside WordPress structures: PHP in uploads, fake wp-config includes, mu-plugins backdoors, fake plugin headers with curl/eval, admin-user injectors and pharma-spam droppers.
Backdoors that hide inside WordPress structures: PHP in uploads, fake wp-config includes, mu-plugins backdoors, fake plugin headers with curl/eval, appended eval in index.php.
Source file: panomity_wordpress_droppers.yar (license MIT, author Panomity GmbH). Scores range from 0 to 100; 85 and above marks a finding as malicious on its own, 40 to 84 as suspicious.
| Rule | Score | What it detects |
|---|---|---|
Panomity_WP_Uploads_PHP_Dropper | 88 | PHP file dropped into wp-content/uploads that writes another PHP payload |
Panomity_WP_Config_Fake_Include | 87 | Fake wp-config style loader that includes and evaluates a hidden payload file |
Panomity_WP_MuPlugins_Backdoor | 90 | mu-plugins auto-loaded backdoor combining add_action with dynamic code execution on request input |
Panomity_WP_Fake_Plugin_Header_Backdoor | 89 | File carrying a WordPress plugin header while fetching and evaluating remote code |
Panomity_WP_Index_Appended_Eval | 86 | WordPress bootstrap file with an appended eval loader over request input |
Reporting a false positive
Send the finding ID, the rule name, the SHA-256 and the file itself to falsepositive@shelltrap.com , from the email address registered in your client area . Mail from another address is not processed, and without the file there is no automatic review.
The file is re-scanned against the current generation and analysed automatically on Panomity’s own hardware in Munich; it is never executed and never passed to a third party. The answer usually arrives within an hour from sentinel@shelltrap.com . A confirmed false positive is allowlisted by SHA-256 in the next signed generation, which is published immediately and reaches every server at its next feed refresh; the rule itself is tightened in a later generation. ClamAV and hash-set hits are never released automatically, and unclear or rejected cases go to a human through a ticket in the client area.