Back to evidence

Sanitized live incident

Opportunistic scan

Native source identity and targetable endpoints are private.

mediumopen
Confidence
96%
First seen
Aug 30, 1:46:34 PM PDT
Evidence through
Aug 30, 1:47:25 PM PDT
AI status
Complete
True positive98% confidence

The alert accurately identifies a rapid, opportunistic enumeration campaign against PHP/WordPress web-shell-style paths. The verified HTTP samples are bodyless GET probes assigned to the php_or_wordpress_probe category, use multiple distinct path hashes, and span roughly 5.34 seconds. Sampled outcomes are redirects or not-found responses; they establish reconnaissance but not exploitation or compromise. No process- or flow-plane event references are available in this incident to assess downstream execution or network consequences.

Attack stage
Reconnaissance — PHP/WordPress web-shell path enumeration
Model
gpt-5.6-sol · 8 evidence calls

Observed impact

  • Confirmed exposure to a rapid web-shell path enumeration campaign.
  • No confirmed command execution, persistence, outbound connection, data access, or other compromise consequence in the available evidence.
  • Observed HTTP handling was limited to redirects and not-found responses in the verified samples.

Deterministic signals

Http.php webshell enumeration96%

Rapid enumeration of PHP and WordPress web-shell paths

472 observations · 12 http

Explicit uncertainty

  • The incident cites no process-plane event IDs. The required process evidence query therefore could not retrieve bounded lifecycle summaries, so workload execution consequences cannot be evaluated from that plane.
  • The incident cites no flow-plane event IDs. The required flow evidence query therefore could not retrieve bounded conntrack summaries, so outbound network consequences cannot be evaluated from that plane.
  • HTTP status codes alone cannot prove exploit success or failure, and the bounded summaries expose response hashes and sizes rather than response content.
  • The source_key is a traffic/workload cluster, not a guaranteed identity; it may represent a proxy, NAT gateway, multiple workers, or another aggregation.
  • Target workload affinity is inferred from configured routing rather than an observed per-request trace edge.

Recommended actions

  1. Retain and monitor the source cluster for continued enumeration, follow-up requests, authentication attempts, or changes from 301/404 outcomes.
  2. Apply proportionate gateway rate limiting or temporary blocking if the activity continues and local policy permits.
  3. Verify that the probed PHP/WordPress paths are not deployed web shells and review application/file-integrity telemetry around the incident window.
  4. Review workload process and egress telemetry for the same time window if available outside this bounded incident, prioritizing unexpected web-server child processes and new outbound connections.
  5. Keep PHP/WordPress components and plugins patched, remove unused endpoints, and ensure direct access to sensitive administrative or upload paths is restricted.