Hunt Strategy & Objective
Find public behavior associated with the reported threat event.
⏱️ Lookback: 30 days
Hunt Hypothesis
The reported threat behavior may be visible in package, process, or web telemetry.
Target Platforms & Environment
Windows
Linux
macOS
Publicly documented affected technology and observable behavior only.
Required Telemetry & Data Sources
process creation
package manifests
network and web logs
Procedural Hunting Sequence
- 1 Scope systems and packages matching the affected technology.
- 2 Search SIEM/EDR and web telemetry using the supplied detection logic and source-linked indicators.
- 3 Triage matches, isolate suspected hosts or sites, and preserve relevant logs.
- 4 Validate findings against package hashes, timestamps, parent processes, and authoritative vendor material.
Hunt Queries
Query Pattern 1
title: Avada WordPress arbitrary PHP execution
description: Detects PHP process execution associated with the publicly reported Avada
WordPress RCE condition; validate fields against available web and process telemetry.
logsource:
product: linux
detection:
selection:
process.command_line: php
condition: selection
level: medium
tags: []
references: []
✓
True Positive Confirmation Evidence
●
Affected package or component versions
●
Matching process or web execution telemetry
!
Benign & False Positive Explanations
●
Legitimate package installation or PHP administration
Validation Checklist
Confirm source URL and event timestamp
Correlate process, package, and network evidence
Escalation Criteria
Confirmed affected version plus suspicious execution or outbound communication
Traceability & Related Detections
🔍 Evidence:
2b116242-f0…
🛡️ Detection: 8ea1b79f-2f…