Smart Slider 3 Pro Supply Chain Compromise: Detection and Eradication Guide

---
title: Potential Webshell Execution via Web Server Process
id: 8a4b1c92-5e6d-4f33-a9b0-1c2d3e4f5a6b
status: experimental
description: Detects web server processes spawning shells, a common indicator of webshell activity associated with the Smart Slider backdoor.
references:
  - https://thehackernews.com/2026/04/backdoored-smart-slider-3-pro-update.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/perl'
      - '/python'
  condition: selection
falsepositives:
  - Legitimate administrative scripting by developers
level: high
---
title: Smart Slider 3 Pro Backdoor File Modification
id: 9b5c2d03-6f7e-0g44-b0c1-2d3e4f5a6b7c
status: experimental
description: Detects modifications to the core Smart Slider 3 Pro plugin file, specifically targeting the malicious update timeframe.
references:
  - https://thehackernews.com/2026/04/backdoored-smart-slider-3-pro-update.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: 'nextend-smart-slider3-pro'
    TargetFilename|endswith: '.php'
  condition: selection
falsepositives:
  - Legitimate plugin updates by administrators
level: medium

// Hunt for suspicious processes spawned by web servers (Webshell activity)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~("apache2", "httpd", "nginx", "php-fpm")
| where FileName in~("sh", "bash", "perl", "python", "wget", "curl")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, CommandLine, AccountName
| order by Timestamp desc

// Hunt for file modifications in the Smart Slider directory
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath contains @"nextend-smart-slider3-pro"
| where ActionType == "FileModified" or ActionType == "FileCreated"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessAccountName, SHA256

-- Hunt for the specific malicious version 3.5.1.35 in the plugin header
SELECT FullPath, Mtime, Atime, Size
FROM glob(globs='/*/wp-content/plugins/nextend-smart-slider3-pro/nextend-smart-slider3-pro.php')
WHERE 
  -- Read file content to check for the malicious version string
  read_file(filename=FullPath) =~ "Version: 3.5.1.35"
  OR 
  -- Also flag if the file was modified recently (last 7 days)
  Mtime > now() - 86400 * 7

-- Hunt for common PHP webshell keywords in the Smart Slider directory
SELECT FullPath, Name
FROM glob(globs='/*/wp-content/plugins/nextend-smart-slider3-pro/**/*.php')
WHERE read_file(filename=FullPath) =~ "(eval\(|base64_decode|assert\(|system\(|passthru\(|shell_exec)"

#!/bin/bash

# Security Arsenal - Smart Slider 3 Pro Remediation Script
# This script checks for the presence of the backdoored version 3.5.1.35

echo "[+] Scanning for Smart Slider 3 Pro version 3.5.1.35..."

# Define base paths (Adjust /var/www/html to your document root)
SEARCH_PATH="/var/www/html"

# Find the main plugin file and check version
find "$SEARCH_PATH" -type f -path "*nextend-smart-slider3-pro/nextend-smart-slider3-pro.php" -print0 | while IFS= read -r -d '' file; do
    if grep -q "Version: 3.5.1.35" "$file"; then
        echo "[!] ALERT: Malicious version 3.5.1.35 found at: $file"
        echo "[!] Recommendation: Immediate removal of the plugin directory and restoration from clean backup."
        # Optional: Quarantine (commented out for safety)
        # mv "$(dirname "$file")" "$(dirname "$file").quarantined"
    else
        echo "[-] Clean or different version found at: $file"
    fi
done

echo "[+] Scanning for common webshell patterns in Smart Slider directory..."

# Search for obfuscated PHP functions often used in backdoors within the specific plugin
find "$SEARCH_PATH" -type f -path "*nextend-smart-slider3-pro/*.php" -exec grep -l "eval\(\\\$_" {} \; 2>/dev/null | while read infected_file; do
    echo "[!] SUSPICIOUS: Potential backdoor signature found in: $infected_file"
done

echo "[+] Scan complete."