July 2026 Threat Brief: WordPress RCE, SonicWall Zero-Days, and AI Service Exploitation

---
title: Potential WordPress or SharePoint Web Shell Activity
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects web server processes spawning command-line shells, a common indicator of RCE exploitation in WordPress and SharePoint.
references:
  - https://attack.mitre.org/techniques/T1505/003
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.web_shell
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\php-cgi.exe'
      - '\php.exe'
      - '\httpd.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate administrative management via web interfaces
level: critical
---
title: Suspicious AI Service API Usage from Non-Browser Process
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
status: experimental
description: Detects non-browser processes connecting to known AI API endpoints, potentially indicating automated abuse or API key theft.
references:
  - https://attack.mitre.org/techniques/T1059/009
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'generativelanguage.googleapis.com'
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
  filter_main_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
  condition: selection and not filter_main_browsers
falsepositives:
  - Legitimate internal applications utilizing AI APIs
level: high
---
title: Suspicious File Download via Command Line
id: c3d4e5f6-7890-12bc-def0-3456789012cd
status: experimental
description: Detects command-line tools downloading content from public file-sharing sites, often used for malicious software delivery in exploit chains.
references:
  - https://attack.mitre.org/techniques/T1105
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\curl.exe'
      - '\wget.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  selection_domain:
    CommandLine|contains:
      - 'pastebin.com'
      - 'transfer.sh'
      - 'gist.githubusercontent.com'
      - 'cdn.discordapp.com'
  condition: all of selection_*
falsepositives:
  - Legitimate developer downloads
level: medium

// Hunt for Web Shells: Web Server processes spawning shells
DeviceProcessEvents
| where InitiatingProcessFileName in ("w3wp.exe", "php-cgi.exe", "httpd.exe", "nginx.exe")
| where FileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, CommandLine
| order by Timestamp desc


// Hunt for AI Service Abuse
DeviceNetworkEvents
| where RemoteUrl has_any ("api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com")
| where InitiatingProcessFileName !in ("chrome.exe", "msedge.exe", "firefox.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| order by Timestamp desc

// Hunt for recently modified web content (Web Shells) in common directories
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs='/**/*.php', root='/var/www/html')
WHERE Mtime > now() - 7d

SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs='/**/*.aspx', root='C:\inetpub\wwwroot')
WHERE Mtime > now() - 7d

# Audit IIS/Web Directories for recently modified files (Potential Web Shells)
# Run with Administrator privileges

$webRoots = @("C:\inetpub\wwwroot", "D:\inetpub\wwwroot")
$daysToCheck = 7
$suspiciousExtensions = @(".php", ".aspx", ".ashx", ".asmx", ".asp")

Write-Host "Scanning for web content modified in the last $daysToCheck days..." -ForegroundColor Cyan

foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include $suspiciousExtensions -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-$daysToCheck) } |
        Select-Object FullName, LastWriteTime, Length, @{Name="Owner";Expression={(Get-Acl $_.FullName).Owner}} |
        Format-Table -AutoSize
    }
}

Write-Host "Scan complete. Review the output for unauthorized files." -ForegroundColor Green