Active Funnel Builder Exploit: WooCommerce Checkout Skimming Detection & Hardening

---
title: WordPress Plugin Directory Modification - Funnel Builder
id: 8a2c1d33-4f5e-4b8a-9c1d-2e3f4a5b6c7d
status: experimental
description: Detects modifications to the Funnel Builder plugin directory, which may indicate exploit activity or web shell upload.
references:
 - https://sansec.io/research/woocommerce-funnel-builder-skimmer
author: Security Arsenal
date: 2026/05/15
tags:
 - attack.initial_access
 - attack.t1190
logsource:
 category: file_event
 product: linux
detection:
 selection:
   TargetFilename|contains: '/wp-content/plugins/funnel-builder'
   TargetFilename|endswith:
     - '.php'
     - '.js'
 filter_legit_updates:
   SubjectUserName|contains: 'root'
 condition: selection and not filter_legit_updates
falsepositives:
 - Legitimate administrator updating the plugin
level: high
---
title: Web Server Process Spawning Shell
id: 9b3d2e44-5g6f-5c9b-0d2e-3f4g5b6c7d8e
status: experimental
description: Detects the web server user (e.g., www-data) spawning a shell process, often indicative of successful RCE or web shell execution.
author: Security Arsenal
date: 2026/05/15
tags:
 - attack.execution
 - attack.t1059.004
logsource:
 category: process_creation
 product: linux
detection:
 selection:
   ParentImage|endswith:
     - '/apache2'
     - '/httpd'
     - '/nginx'
   SubjectUserName|contains:
     - 'www-data'
     - 'apache'
     - 'nginx'
 selection_img:
   Image|endswith:
     - '/bash'
     - '/sh'
     - '/perl'
     - '/python'
 condition: selection and selection_img
falsepositives:
 - Legitimate administrative debugging
level: high
---
title: Potential Web Skimming Payload in Web Logs
id: 1c4e3f55-6h7g-6d0c-1e3f-4g5h6c7d8e9f
status: experimental
description: Detects suspicious encoded strings often associated with JavaScript skimming payloads in access logs.
author: Security Arsenal
date: 2026/05/15
tags:
 - attack.persistence
 - attack.t1059.006
logsource:
 category: webserver
 product: apache
detection:
 selection:
   c_ip|startswith: '192.168.' # Example: Exclude internal IPs if needed, or remove if scanning all
   cs_uri_query|contains:
     - 'eval('
     - 'fromCharCode'
     - 'document.cookie'
   cs_method: 'POST'
 condition: selection
falsepositives:
 - Legitimate API testing
level: medium

// Hunt for file modifications in WordPress plugin directories within the last 24 hours
Syslog
| where ProcessName contains "httpd" or ProcessName contains "nginx"
| where SyslogMessage contains "wp-content/plugins/funnel-builder"
| project TimeGenerated, Computer, SyslogMessage, ProcessName
| sort by TimeGenerated desc

// Hunt for web server processes spawning interactive shells (Potential Web Shell)
DeviceProcessEvents  
| where InitiatingProcessFileName in ("httpd", "nginx", "apache2")
| where FileName in ("sh", "bash", "perl", "python", "php")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, CommandLine
| sort by Timestamp desc

-- Hunt for potential skimming code in WordPress plugin directories
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs='/*/wp-content/plugins/funnel-builder/**/*.php')
WHERE read_file(filename=FullPath) =~ 'eval\(' 
   OR read_file(filename=FullPath) =~ 'document\.cookie' 
   OR read_file(filename=FullPath) =~ 'base64_decode'

#!/bin/bash

# Emergency Remediation Script for Funnel Builder Vulnerability
# Action: Disables the plugin and checks for recent modifications

# Define path to WordPress (Update this if different)
WP_PATH="/var/www/html"

echo "[+] Disabling Funnel Builder plugin via WP-CLI..."
# Assumes WP-CLI is installed and configured
if command -v wp &> /dev/null; then
    cd $WP_PATH
    wp plugin deactivate funnel-builder --allow-root
    echo "[+] Plugin deactivated."
else
    echo "[!] WP-CLI not found. Manual deactivation required."
    echo "[!] Please rename the plugin directory manually to disable it:"
    echo "    mv $WP_PATH/wp-content/plugins/funnel-builder $WP_PATH/wp-content/plugins/funnel-builder.bak"
fi

echo "[+] Scanning for recently modified files in the plugin directory..."
find $WP_PATH/wp-content/plugins/funnel-builder -type f -mtime -7 -ls

echo "[+] Searching for common skimming patterns in plugin files..."
grep -r "eval(" $WP_PATH/wp-content/plugins/funnel-builder/ | head -n 5

echo "[+] Remediation steps taken. Immediate forensic investigation recommended."