TRUST#GRAFT WordPress Admin PHP Backdoor + Year-End Phishing Credential Harvesting: OTX Pulse Analysis — Enterprise Detection Pack

---
title: TRUST#GRAFT Fake Cloudflare ClickFix JavaScript Loader Execution
id: 7c3a1f2e-9b41-4d6a-a8e5-2f1c9d4b6a01
status: experimental
description: Detects browser process spawning command interpreters or script hosts consistent with ClickFix-style fake verification lures and clipboard/paste-execution patterns observed in TRUST#GRAFT Web Media Optimizer campaigns.
author: Security Arsenal Threat Intelligence
date: 2026/10/24
references:
    - https://www.securonix.com/blog/trust-graft-wordpress-admin-php-backdoor/
logsource:
    category: process_creation
    product: windows
detection:
    selection_browser_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\rundll32.exe'
    condition: selection_browser_parent and selection_child
falsepositives:
    - Browser-based legitimate admin tooling (rare)
level: high
tags:
    - attack.initial_access
    - attack.t1189
    - attack.t1204
    - attack.t1059
---
title: TRUST#GRAFT PHP Backdoor Dropped Into WordPress Content Directories
id: 8d4b2f3a-1c52-4e7b-b9f6-3a2d0e5c7b12
status: experimental
description: Detects web server processes (php-fpm, apache, nginx, IIS worker) writing PHP files into WordPress content, uploads, theme, or plugin directories — consistent with TRUST#GRAFT abuse of authenticated admin sessions to deploy persistent PHP backdoors.
author: Security Arsenal Threat Intelligence
date: 2026/10/24
references:
    - https://www.securonix.com/blog/trust-graft-wordpress-admin-php-backdoor/
logsource:
    category: file_event
    product: linux
    service: webserver
detection:
    selection_path:
        TargetFilename|contains:
            - '/wp-content/uploads/'
            - '/wp-content/themes/'
            - '/wp-content/plugins/'
            - '/wp-includes/'
    selection_ext:
        TargetFilename|endswith: '.php'
    filter_known:
        TargetFilename|contains:
            - '/wp-content/plugins/'  # plugin installs write here legitimately; tune per CMS management workflow
    condition: selection_path and selection_ext and not filter_known
falsepositives:
    - Legitimate plugin/theme installations via WP admin panel — correlate with admin audit logs and change windows
level: high
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.t1100
---
title: Network Connection to TRUST#GRAFT or Year-End Phishing Infrastructure
id: 9e5c3a4b-2d63-4f8c-c0a7-4b3e1f6d8c23
status: experimental
description: Detects DNS resolution or outbound connection to domains associated with the TRUST#GRAFT loader C2 and the 2026 year-end phishing lure infrastructure published in OTX pulses.
author: Security Arsenal Threat Intelligence
date: 2026/10/24
logsource:
    category: dns
    product: windows
detection:
    selection_domain:
        query|contains:
            - 'gerlace.com'
            - 'caapman.me'
            - 'okuneva.sbs'
            - 'vtevens.icu'
            - 'englaus.sbs'
            - 'rsfashionsdesignbd.com'
            - 'bvlbetonvloeren.be'
            - 'tropical100.com.do'
    condition: selection_domain
falsepositives:
    - Threat research activity
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1566

// Sentinel hunt: TRUST#GRAFT C2 + year-end phishing infrastructure + ClickFix browser-spawned execution
let SuspiciousDomains = dynamic(["gerlace.com","caapman.me","okuneva.sbs","vtevens.icu","englaus.sbs","rsfashionsdesignbd.com","bvlbetonvloeren.be","tropical100.com.do"]);
let SuspiciousIPs = dynamic(["157.7.189.101","157.7.44.119","118.20.84.128","123.98.253.31"]);
let ScriptHosts = dynamic(["powershell.exe","pwsh.exe","cmd.exe","mshta.exe","wscript.exe","cscript.exe","rundll32.exe"]);
let Browsers = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe"]);
union isfuzzy=true
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has_any (SuspiciousDomains) or RemoteIP in (SuspiciousIPs)
    | project HuntType="NetworkIOC", TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where InitiatingProcessFileName in~ (Browsers) and FileName in~ (ScriptHosts)
    | project HuntType="ClickFixExecution", TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
),
(
    DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where SHA256 in~ ("07955dcb5f4f80c90ede398879589f2e369eb2d84c4975d3c8adf08433783409","0a3cb24e0d0c05b544a3e32affe3ea8a4ed87c0cc90e918c10b94d3b849d76fa")
       or MD5 in~ ("197f6a5103870ab3bb1a213f27a63c73")
    | project HuntType="MalwareHash", TimeGenerated, DeviceName, FolderPath, FileName, SHA256
)
| sort by TimeGenerated desc

# Security Arsenal - TRUST#GRAFT & Year-End Phishing Host Hunt
# Run elevated on endpoints and (adapted paths) WordPress servers
$ErrorActionPreference = 'SilentlyContinue'
$Report = @()

# 1) Check DNS client cache for malicious domains
$badDomains = @('gerlace.com','caapman.me','okuneva.sbs','vtevens.icu','englaus.sbs','rsfashionsdesignbd.com','bvlbetonvloeren.be','tropical100.com.do')
$dns = Get-DnsClientCache | Where-Object { $n = $_.Name; $badDomains | Where-Object { $n -like "*$_*" } }
if ($dns) { $Report += [pscustomobject]@{Check='DNSCache'; Finding=($dns | Out-String)} }

# 2) Active/established connections to malicious IPs
$badIPs = @('157.7.189.101','157.7.44.119','118.20.84.128','123.98.253.31')
$conns = Get-NetTCPConnection -State Established | Where-Object { $_.RemoteAddress -in $badIPs }
if ($conns) { $Report += [pscustomobject]@{Check='NetConnections'; Finding=($conns | Select-Object LocalPort,RemoteAddress,RemotePort,OwningProcess | Out-String)} }

# 3) Hash sweep for known Web Media Optimizer payloads
$badHashes = @('07955dcb5f4f80c90ede398879589f2e369eb2d84c4975d3c8adf08433783409','0a3cb24e0d0c05b544a3e32affe3ea8a4ed87c0cc90e918c10b94d3b849d76fa')
$sweepPaths = @('C:\inetpub','C:\xampp\htdocs','C:\wamp64\www','C:\Users\Public\Downloads')
foreach ($p in $sweepPaths) {
    Get-ChildItem -Path $p -Recurse -Include *.php,*.js,*.exe,*.dll -File | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        if ($badHashes -contains $h) { $Report += [pscustomobject]@{Check='MalwareHash'; Finding=$_.FullName} }
    }
}

# 4) WordPress PHP backdoor sweep: recently modified .php files in uploads (should be near-zero)
$wpRoots = @('C:\inetpub\wwwroot','C:\xampp\htdocs','/var/www/html')
foreach ($root in $wpRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.php -File |
            Where-Object { $_.FullName -match 'wp-content\\uploads' -and $_.LastWriteTime -gt (Get-Date).AddDays(-90) } |
            ForEach-Object { $Report += [pscustomobject]@{Check='UploadsPHP'; Finding="$($_.FullName) modified $($_.LastWriteTime)"} }
    }
}

# 5) Persistence review: suspicious scheduled tasks & run keys spawned by browsers/script hosts
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'powershell|mshta|wscript|cscript|rundll32' -and $_.TaskPath -notlike '\Microsoft*' } |
    ForEach-Object { $Report += [pscustomobject]@{Check='ScheduledTask'; Finding="$($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)"} }
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
    (Get-ItemProperty $k).PSObject.Properties | Where-Object { $_.Value -match 'powershell|mshta|wscript|appdata' } |
        ForEach-Object { $Report += [pscustomobject]@{Check='RunKey'; Finding="$k\$($_.Name) = $($_.Value)"} }
}

if ($Report.Count -eq 0) { Write-Output '[+] No TRUST#GRAFT / phishing indicators found.' } else { $Report | Format-List }