Link: Suspicious wp-admin path from mismatched sender domain

calendar Jul 17, 2026  ·
Share on: linkedin copy

Detects inbound messages containing links to a WordPress /wp-admin/ path where the link domain does not match the sender's domain. Matches two patterns: a single directory under /wp-admin/ with no file extension, or a .php payload nested at least one subdirectory below /wp-admin/ (e.g. /wp-admin/foo/bar.php). Both are indicative of compromised WordPress sites being repurposed to host phishing pages; legitimate WP notification paths like/wp-admin/admin.php are excluded by the subdirectory requirement.

Sublime rule (View on GitHub)

 1name: "Link: Suspicious wp-admin path from mismatched sender domain"
 2description: "Detects inbound messages containing links to a WordPress /wp-admin/ path where the link domain does not match the sender's domain. Matches two patterns: a single directory under /wp-admin/ with no file extension, or a .php payload nested at least one subdirectory below /wp-admin/ (e.g. /wp-admin/foo/bar.php). Both are indicative of compromised WordPress sites being repurposed to host phishing pages; legitimate WP notification paths like/wp-admin/admin.php are excluded by the subdirectory requirement."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // either a single dir under /wp-admin/ with no file extension or a .php payload nested at least one subdirectory below /wp-admin/
 8  and any(body.links,
 9          regex.icontains(.href_url.path,
10                          '^/wp-admin/[^/\.]+/?$',
11                          '/wp-admin/[^/]+/[^/]+\.php$'
12          )
13          // domain is not the same as the sender domain
14          and .href_url.domain.root_domain != sender.email.domain.root_domain
15  )
16  and not (
17    (
18      sender.email.domain.root_domain in $high_trust_sender_root_domains
19      // website security companies that send reports via email
20      or sender.email.domain.root_domain in ('imperva.com', 'urllo.com')
21    )
22    and coalesce(headers.auth_summary.dmarc.pass, false)
23  )
24    
25attack_types:
26  - "Credential Phishing"
27tactics_and_techniques:
28  - "Evasion"
29  - "Social engineering"
30  - "Spoofing"
31detection_methods:
32  - "URL analysis"
33  - "Sender analysis"
34  - "Header analysis"
35id: "e8fa7870-b771-5dcd-b5f3-59f866ba00e2"
to-top