[EXP] Joomla Extension Exploitation and Unauthenticated PHP Webshell Execution Risk

Report Type: EXP
Threat Category: Joomla Extension Exploitation / Public Web Application Compromise
Assessment Date: July 07, 2026
Primary Impact Domain: Public Web Trust and Hosted-Content Integrity
Secondary Impact Domains: Credential Exposure, CMS Integrity, Abuse Infrastructure, Customer and Partner Trust, Regulatory and Legal Exposure
Affected Asset Class: Internet-Facing Joomla Sites, Joomla Extensions, Writable Webroot Paths, CMS Administrator Accounts, Hosting-Control Workflows
Threat Objective Classification: Public CMS Exploitation, PHP Webshell Execution, Credential Access, Hosted-Content Tampering, Abuse-Infrastructure Enablement

Published by: CyberDax LLC
Author: Edward “Tony” Dolley
Role: Founder / Principal Threat Researcher, CyberDax LLC
Publication Date: July 07, 2026
Publication Type: Cybersecurity Research Report / White Paper

BLUF

‍  Joomla extension exploitation and unauthenticated PHP webshell execution creates material business risk because exposed Joomla sites may support customer-facing web services, public brand presence, partner access, lead generation, e-commerce-adjacent workflows, content publishing, marketing operations, and business-critical web infrastructure. The core risk is whether unauthenticated extension upload, profile import, custom-icon upload, media upload, AJAX upload, or component-owned file placement allowed adversaries to place PHP-like artifacts in web-accessible paths, execute attacker-controlled code, access configuration or credential material, alter hosted content, create persistence, or use the Joomla host as abuse infrastructure before the organization can validate exposure, webroot integrity, administrator state, credential risk, outbound activity, and hosted-content trust. Immediate executive action is required to confirm exposed Joomla assets, affected extension usage, writable-path controls, PHP execution restrictions, webroot integrity, administrator and Super User state, credential exposure, outbound communication, hosting-control activity, abuse reports, and the organization’s ability to distinguish routine Joomla administration from extension-abuse-aligned compromise behavior.

Executive Risk Translation

Joomla extension exploitation shifts the business risk from a conventional website vulnerability to uncertainty over whether a public web property can still be trusted as a clean customer-facing, partner-facing, or operational service. If the organization cannot reliably connect suspicious extension activity to file state, CMS state, credential exposure, outbound activity, hosting-control activity, and hosted-content review, leadership may need to assume that attacker-controlled PHP execution, credential exposure, content tampering, phishing pages, malware hosting, spam infrastructure, or persistence occurred until proven otherwise. That response can expand into emergency patch validation, extension removal or hardening, webroot integrity review, credential rotation, database and configuration review, content restoration, hosting-provider coordination, abuse-desk response, legal and compliance assessment, cyber-insurance coordination, executive reporting, and customer or partner trust management.

S3 — Why This Matters Now

·        Joomla sites often sit directly on the public internet and may support customer portals, marketing sites, partner workflows, e-commerce-adjacent paths, content delivery, brand trust, and operational web services.

·        Extension upload and profile-import abuse is materially different from routine scanning because successful exploitation may allow attacker-controlled files to be written into web-accessible Joomla paths.

·        PHP-like file placement in writable Joomla paths can give adversaries a path to webshell execution, credential access, hosted-content modification, outbound communication, and persistence without needing a traditional endpoint intrusion first.

·        Public exploit activity and vulnerable extension exposure should increase urgency, but compromise confidence must come from correlated request, file, process, CMS state, outbound, hosting-control, or content-impact evidence.

·        Patching alone is not sufficient containment when suspicious upload activity, PHP artifact creation, webshell access, configuration-file access, administrator changes, FTP activity, outbound communication, or hosted-content tampering occurred before remediation.

·        The highest-risk condition occurs when unauthenticated Joomla extension upload or import behavior is followed by PHP-like file placement, HTTP access to the planted file, web server service-context execution, credential-file access, rare egress, administrator or Super User changes, hosting-control activity, or visible content impact.

·        Joomla environments can make malicious activity difficult to classify because legitimate extension updates, template changes, media uploads, backup jobs, migrations, vulnerability validation, hosting-provider support, malware cleanup, and emergency remediation can resemble suspicious behavior when viewed in isolation.

·        Missing query strings, rotated web logs, incomplete Joomla audit records, weak file telemetry, absent endpoint visibility, limited hosting-provider records, or incomplete CMS database review can force broader investigation because the organization cannot quickly prove whether webshell execution or content impact occurred.

S4 — Key Judgments

·        Joomla extension exploitation and unauthenticated PHP webshell execution should be treated as a web trust, hosted-content integrity, credential exposure, and abuse-infrastructure risk, not only as a vulnerability-management ticket or website patch event.

·        The primary enterprise risk is reduced ability to determine whether unauthenticated extension upload, profile import, custom-icon upload, media upload, AJAX upload, or component-owned file placement led to executable PHP artifacts, webshell access, credential exposure, persistence, outbound communication, or hosted-content tampering.

·        Suspicious Joomla extension request activity followed by PHP-like file creation, HTTP access to newly created files, web server process execution, sensitive-file access, rare egress, administrator changes, or content modification is the strongest executive risk signal.

·        A single Joomla request, scanner hit, vulnerable-version finding, public exploit reference, unusual user agent, PHP filename, or web error should not be treated as confirmed compromise without supporting request-to-file, file-to-execution, CMS-state, outbound, hosting-control, or hosted-content evidence.

·        Business exposure increases sharply when affected Joomla sites support customer portals, regulated content, payment-adjacent workflows, lead generation, partner access, executive communications, marketing campaigns, support portals, file distribution, brand-sensitive pages, or high-traffic public services.

·        Incomplete telemetry increases cost because the organization may need to reconstruct Joomla request activity, extension state, file placement, webshell access, credential-file exposure, administrator state, outbound communication, FTP activity, hosting-control activity, and hosted-content integrity across separate systems.

·        The most damaging outcome occurs when Joomla extension exploitation results in confirmed or suspected PHP webshell execution, credential exposure, administrator or Super User manipulation, database access, malicious redirects, phishing pages, malware hosting, spam infrastructure, customer-facing integrity loss, legal and compliance review, cyber-insurance scrutiny, or board-level concern about web-platform resilience.

S5 — Executive Risk Summary

Business Risk

Joomla extension exploitation can weaken the organization’s ability to trust public websites, hosted content, customer-facing pages, partner-facing workflows, and web infrastructure that supports business operations. Risk increases when exposed Joomla instances support customer portals, brand-sensitive content, lead generation, e-commerce-adjacent workflows, regulated information, partner access, file downloads, support workflows, marketing operations, or business-critical web services. The business impact is not limited to the vulnerable extension; it can expand into uncertainty about whether adversaries placed PHP webshells, accessed configuration files, obtained database credentials, altered website content, created phishing pages, hosted malware, sent spam, modified redirects, abused hosting-control access, or retained persistence after apparent remediation.

Technical Cause

The risk is driven by unauthenticated or weakly controlled Joomla extension upload, import, profile, custom-icon, asset, media, image, library, or AJAX handling behavior that can allow attacker-controlled upload state or PHP-like file placement in web-accessible paths. Technical exposure becomes material when suspicious extension requests align with new or modified PHP, phtml, phar, mixed-case PHP, double-extension, archive-extracted, or obfuscated PHP artifacts in writable Joomla directories such as media, images, tmp, cache, uploads, assets, iconfont, gfonts, templates, plugins, components, modules, or extension-owned paths. Exposure increases when Joomla extension inventory, writable-path inventory, PHP execution controls, file-integrity coverage, endpoint visibility, CMS state review, outbound monitoring, FTP logging, hosting-control logging, and backup comparison are incomplete or poorly coordinated.

Threat Posture

The threat posture is elevated because Joomla extension exploitation can turn a public website into an attacker-controlled execution point, credential source, persistence location, redirect platform, phishing host, malware distribution point, spam relay, or staging environment. Exploitation may not begin with malware on an employee endpoint or identity compromise because the initial path can be direct unauthenticated access to vulnerable extension functionality on a public web application. The posture becomes critical when suspicious Joomla activity affects sites tied to customer trust, regulated information, authentication workflows, payment-adjacent processes, executive messaging, partner access, support portals, public downloads, high-visibility brand pages, shared hosting, or infrastructure where multiple web properties depend on the same backend host or credentials.

Executive Decision Requirement

Executives must require measurable assurance that exposed Joomla assets are inventoried, affected extensions are identified, vulnerable extension behavior is remediated, writable paths are reviewed, PHP execution is restricted where feasible, webroot integrity is validated, suspicious PHP-like artifacts are investigated, Joomla administrator and Super User state is reviewed, configuration and credential files are inspected, outbound communication is examined, FTP and hosting-control activity is checked, hosted content is reviewed, abuse complaints are assessed, and post-remediation monitoring is operational. Leadership should also require evidence that legal, compliance, cyber insurance, hosting providers, web administrators, application owners, SOC, incident response, communications, and business owners can support rapid decisions if webshell execution, credential exposure, content tampering, malware hosting, phishing, spam infrastructure, or customer-facing trust impact is suspected.

S6 — Executive Cost Summary

Joomla extension exploitation and unauthenticated PHP webshell execution create financial exposure because the organization must determine whether a public web property allowed adversaries to place executable content, run attacker-controlled code, access credentials, alter hosted content, create persistence, or use the website as abuse infrastructure. The cost profile is different from a routine extension update because the affected Joomla site may support customer trust, public communications, partner engagement, marketing operations, e-commerce-adjacent workflows, support services, regulated content, or business-critical web delivery. Response cost is driven by the work required to validate asset exposure, identify affected extensions, preserve web and WAF records, inspect Joomla extension state, review writable paths, search for PHP-like artifacts, analyze webshell access, inspect configuration files, rotate credentials, review administrator state, investigate outbound communication, coordinate with hosting providers, review hosted content, and prove that post-remediation abuse has stopped.

Cost increases materially when web records rotate quickly, Joomla audit records are absent, CMS database state requires manual inspection, shared hosting limits endpoint visibility, file telemetry is unavailable, outbound activity cannot be tied to the Joomla host, FTP logs are incomplete, hosting-control logs are unavailable, backup comparison is weak, approved administrator activity is not baselined, or business owners cannot quickly identify which web properties and customer workflows depend on the affected Joomla instance. The highest-cost cases occur when suspected or confirmed compromise affects customer-facing portals, brand-sensitive pages, regulated information, payment-adjacent workflows, file distribution, partner access, executive communications, high-traffic public sites, shared hosting environments, reused credentials, or multiple Joomla properties on the same infrastructure.

Low Impact Scenario

Rapid investigation confirms suspicious Joomla extension upload or import activity without evidence of PHP-like file placement, webshell access, web server service-context execution, credential-file access, administrator or Super User changes, outbound communication, FTP activity, hosting-control abuse, hosted-content tampering, phishing pages, malware hosting, spam infrastructure, or post-remediation activity. Activity may involve internet scanning, failed upload attempts, malformed extension requests, abnormal response behavior, upload-handler errors, or limited PHP access attempts, but web records, WAF records, Joomla extension state, file review, CMS database records, hosting-provider records, and content review support a failed, contained, or non-impacting event. Response is limited to targeted extension remediation, exposure review, evidence preservation, focused webroot inspection, PHP execution validation, administrator review, credential precaution, short-term monitoring, and executive assurance that website integrity and customer-facing trust were not materially affected. Estimated impact $350K - $2.8M.

Moderate Impact Scenario

Confirmed or strongly suspected Joomla extension exploitation affects one or more public Joomla sites where suspicious upload or import behavior aligns with PHP-like file placement, HTTP access to the planted file, sensitive-file access, rare outbound communication, administrator state changes, FTP activity, hosting-control activity, or hosted-content modification. The organization cannot immediately determine whether attacker-controlled PHP executed, credentials were exposed, configuration files were accessed, database material was reviewed, redirects were altered, phishing pages were staged, spam scripts were placed, or persistence remained after remediation. Response requires enterprise-focused Joomla asset review, web and WAF record reconstruction, extension inventory validation, webroot integrity review, file and database inspection, credential rotation, administrator and Super User review, outbound traffic analysis, hosting-provider coordination, content review, abuse-desk handling, vulnerability-management validation, legal and compliance review, cyber-insurance coordination, executive reporting, and strengthened monitoring for post-remediation activity. Estimated impact $3.5M - $18M.

High Impact Scenario

Joomla extension exploitation becomes an enterprise-impact event when suspected or confirmed webshell execution results in credential exposure, database access, administrator compromise, malicious redirects, phishing pages, malware hosting, spam infrastructure, customer-facing content tampering, partner workflow exposure, regulated data concern, multi-site compromise, or persistent attacker access through webroot, CMS, FTP, hosting-control, or reused credentials. The organization may need to assume that customer-facing services, public content, regulated information, website credentials, database material, administrator accounts, partner workflows, hosting environments, or adjacent web properties were affected until audit evidence proves otherwise. Response may require extended web forensics, broad credential rotation, database and configuration review, backup comparison, content restoration, removal of malicious artifacts, hosting-provider escalation, abuse-desk remediation, customer or partner notification analysis, legal and privacy escalation, cyber-insurance engagement, communications planning, executive and board reporting, and formal validation that Joomla sites and dependent web services can safely remain online. Estimated impact $22M - $95M+.

S6A — Key Cost Drivers

·        Number and sensitivity of affected Joomla sites, including public websites, customer portals, partner-facing services, brand-sensitive pages, e-commerce-adjacent workflows, regulated content, support portals, and high-traffic web properties.

·        Scope of affected Joomla extensions and upload behaviors, including editor profile import, custom icon upload, page-builder upload, asset upload, media upload, image upload, AJAX upload, archive extraction, and component-owned writable paths.

·        Availability and retention of WAF records, reverse-proxy records, CDN records, load-balancer records, web access records, query strings, Joomla administrative records, CMS database records, file-integrity telemetry, endpoint telemetry, DNS records, proxy records, firewall records, FTP records, hosting-control records, backup records, malware scan results, and abuse-desk records.

·        Whether response must reconstruct suspicious extension requests, PHP-like file placement, HTTP access to planted files, web server process execution, configuration-file access, outbound communication, administrator changes, FTP activity, hosting-control activity, and hosted-content changes across separate telemetry sources.

·        Whether PHP execution can be disabled in writable Joomla directories without breaking business operations, media workflows, templates, plugins, page builders, deployment processes, hosting-provider workflows, or approved maintenance activity.

·        Scope of sensitive material potentially exposed, including configuration.php, database credentials, database dumps, backup archives, environment files, FTP material, mail settings, API keys, customer records, partner information, regulated content, and administrator credentials.

·        Size and complexity of the affected web environment, including shared hosting, managed hosting, dedicated Joomla servers, containerized Joomla workloads, cloud-hosted Joomla sites, multiple virtual hosts, reused credentials, shared databases, and common deployment workflows.

·        Ability to distinguish legitimate Joomla administration, extension updates, template changes, media uploads, backups, migrations, malware scans, vulnerability validation, hosting-provider support, emergency cleanup, and incident-response activity from attacker-driven behavior.

·        Need to rotate or review Joomla administrator credentials, database credentials, FTP credentials, hosting-control credentials, SSH credentials, mail credentials, API keys, reused passwords, deployment secrets, and backup access.

·        Business disruption caused by emergency extension removal, Joomla patching, PHP execution restrictions, webroot cleanup, content restoration, administrator lockouts, credential rotation, hosting-provider changes, traffic blocking, CDN or WAF tuning, and customer-facing service interruption.

·        Legal, privacy, regulatory, cyber-insurance, communications, customer, partner, executive, or board-level obligations triggered by suspected credential exposure, regulated data access, customer-facing tampering, phishing, malware hosting, spam infrastructure, incomplete containment, or inability to prove non-exposure.

S6B — Compliance and Risk Context

Figure 1

Joomla extension exploitation executive risk model showing how exposed public website functionality can escalate from vulnerable extension behavior into webshell execution, credential exposure, hosted-content compromise, abuse infrastructure, customer-facing trust impact, and enterprise-level business exposure.

Compliance Exposure Indicator

High

Risk Register Entry

Risk Title

Joomla Extension Exploitation and Unauthenticated PHP Webshell Execution Risk

Risk Description

Adversaries may exploit unauthenticated or weakly controlled Joomla extension upload, import, profile, custom-icon, asset, media, image, library, or AJAX behavior to move from suspicious public web requests into PHP-like file placement, webshell access, credential-file exposure, administrator changes, outbound communication, persistence, hosted-content tampering, phishing pages, malware hosting, spam infrastructure, or multi-site compromise. This may increase business interruption, customer-facing trust degradation, brand damage, credential exposure, regulated data concern, partner workflow exposure, legal and compliance review, cyber-insurance scrutiny, customer or partner notification analysis, search-engine or abuse-provider action, and board-level concern around public web-platform resilience. Compliance exposure should be driven by local evidence of credential exposure, regulated data access, customer-facing tampering, phishing, malware hosting, spam infrastructure, administrator compromise, database access, hosting-control abuse, or post-remediation activity, not by vulnerable-version status, scanner traffic, public exploit availability, or isolated Joomla request activity alone.

Likelihood

High

Impact

Severe

Risk Rating

Critical

Annualized Risk Exposure

Estimated $3.5M - $22M+ for materially exposed enterprise environments with public Joomla sites, vulnerable or weakly controlled extensions, customer-facing or partner-facing workflows, sensitive hosted content, incomplete query-string logging, weak webroot integrity monitoring, limited endpoint visibility, shared hosting constraints, unclear writable-path controls, incomplete Joomla extension inventory, weak outbound monitoring, incomplete FTP or hosting-control logs, or poor administrator activity baselines. Exposure may exceed $22M - $95M+ where Joomla extension exploitation results in confirmed or suspected PHP webshell execution, credential exposure, database access, administrator compromise, malicious redirects, phishing pages, malware hosting, spam infrastructure, customer-facing integrity loss, regulated data concern, multi-site compromise, incomplete containment, cyber-insurance review, legal escalation, communications response, or board-level reporting.

S7 — Risk Drivers

·        Joomla sites can concentrate public brand trust, customer engagement, partner workflows, marketing operations, support services, file distribution, and business-critical web delivery on internet-facing infrastructure.

·        Extension upload, profile import, custom icon upload, media upload, AJAX upload, and page-builder behavior can create high-risk exposure when attacker-controlled files reach web-accessible paths.

·        PHP-like file placement in writable Joomla paths can enable webshell execution, credential access, persistence, outbound communication, content tampering, phishing, malware hosting, and spam infrastructure.

·        Vulnerable-version status and public exploit availability can create urgency, but they cannot prove compromise or non-compromise without correlated request, file, process, CMS state, outbound, hosting-control, or content-impact evidence.

·        Patch completion can create false closure when pre-remediation upload activity, PHP access, file placement, credential-file access, administrator changes, outbound activity, or hosted-content changes have not been reviewed.

·        Joomla web activity, extension updates, media uploads, template changes, backups, migrations, malware scans, vulnerability validation, and hosting-provider support can resemble suspicious behavior without strong baselines.

·        Business exposure increases when affected sites support customer portals, partner workflows, regulated content, payment-adjacent processes, executive communications, public downloads, support portals, high-traffic pages, or multiple web properties on shared infrastructure.

·        Missing or inconsistent web records, query strings, Joomla administrative records, CMS database records, file telemetry, endpoint telemetry, outbound logs, FTP logs, hosting-control records, backup comparison data, or abuse-desk records can increase investigation scope and cost.

·        Limited ability to rapidly identify writable paths, restrict PHP execution, review administrator state, inspect configuration files, rotate credentials, compare backups, and validate hosted content can extend operational disruption.

·        Webshell execution, credential exposure, database access, malicious redirects, phishing, malware hosting, spam infrastructure, customer-facing tampering, and incomplete containment can transform a website vulnerability into legal, regulatory, communications, cyber-insurance, customer, partner, executive, and board-level exposure.

S8 — Bottom Line for Executives

Joomla extension exploitation and unauthenticated PHP webshell execution should be treated as a high-priority public web trust, credential exposure, hosted-content integrity, and containment-validation risk because it can turn a routine website component into a path for attacker-controlled code execution and visible business impact. The executive question is not only whether the extension was patched, whether a scanner touched a Joomla endpoint, whether a PHP file exists, or whether a website is still online; it is whether the organization can prove that suspicious Joomla activity did not lead to PHP webshell execution, credential-file access, administrator compromise, database access, outbound communication, content tampering, phishing, malware hosting, spam infrastructure, or continued access after remediation. Response must focus on validating exposure, extension state, web and WAF records, webroot integrity, writable-path controls, PHP execution restrictions, administrator state, credential exposure, outbound activity, hosting-control records, hosted-content review, and post-remediation monitoring before leadership can rely on Joomla-hosted services and public website integrity.

S9 — Board-Level Takeaway

Joomla extension exploitation turns public website security into a board-level issue involving brand trust, customer-facing integrity, credential protection, abuse-infrastructure risk, and business-continuity confidence. The risk is not simply that an extension was vulnerable, a patch was required, or internet scanning occurred; it is the possibility that adversaries used unauthenticated extension behavior to place executable PHP content, access credentials, alter hosted content, create malicious redirects, stage phishing pages, host malware, send spam, or retain persistence on infrastructure customers and partners can directly touch. Leadership should require evidence that Joomla asset inventory, extension inventory, patch validation, WAF and web records, query-string retention, file-integrity review, writable-path controls, PHP execution restrictions, CMS state review, credential rotation, outbound monitoring, hosting-provider coordination, abuse-desk response, legal readiness, and business-continuity planning can support rapid, defensible decisions when Joomla webshell execution or hosted-content trust exposure is suspected.

S10 — Threat Overview

Joomla extension exploitation and unauthenticated PHP webshell execution describes adversary behavior in which exposed Joomla sites may be abused through vulnerable or weakly controlled extension upload, import, profile, custom-icon, asset, media, image, library, archive extraction, or AJAX handling behavior. The behavior is most relevant when unauthenticated or unusual Joomla extension requests align with attacker-controlled upload state, PHP-like file placement in web-accessible paths, HTTP access to newly created files, web server service-context execution, configuration or credential-file access, outbound communication, administrator or Super User changes, hosted-content tampering, phishing pages, malware hosting, spam infrastructure, or persistence.

·        This is not only a scanner, vulnerable-version, KEV, proof-of-concept, single-request, single-source-IP, user-agent, file-name, exploit-string, or IOC-only model.

·        The core threat behavior is movement from public Joomla extension access into attacker-controlled upload or profile state, PHP-like file placement, web-accessible execution, credential exposure, hosted-content manipulation, outbound communication, abuse infrastructure, or persistence.

·        Public Joomla sites and customer-managed Joomla deployments are the relevant exposure class when they use editor, page-builder, media, icon, font, asset, AJAX, profile, upload, or component-owned extensions that can write into web-accessible paths.

·        The primary risk is reduced ability to determine whether Joomla activity remained routine administration, extension update, media upload, vulnerability validation, or hosting-provider maintenance, or crossed into unauthorized PHP placement, webshell execution, credential access, hosted-content tampering, or abuse infrastructure.

·        Web access records, WAF records, reverse-proxy records, CDN records, load-balancer records, Joomla administrative records, CMS database records, file telemetry, endpoint telemetry, DNS records, proxy records, firewall records, FTP records, hosting-control records, backup comparison data, malware scan results, and abuse-desk records may be incomplete or difficult to reconcile during active investigation.

·        The behavior can create uncertainty around public website integrity, customer-facing trust, hosted-content authenticity, administrator control, credential protection, database exposure, hosting-provider response, search-engine or abuse-provider action, legal exposure, and business continuity.

·        Public reporting on Joomla extension exploitation, unauthenticated upload behavior, PHP webshell placement, vulnerable page-builder or editor extensions, and active probing should support the relevance and urgency of the behavior class but should not narrow the report into an actor-only, IOC-only, scanner-only, payload-only, exploit-string-only, or single-CVE-only report.

S11 — Threat Classification and Type

Threat Type

Public web application extension exploitation and PHP webshell execution risk.

Threat Sub-Type

Joomla extension upload abuse, unauthenticated profile import abuse, custom-icon upload abuse, page-builder asset upload abuse, media or image upload abuse, AJAX upload abuse, archive extraction abuse, component-owned writable-path abuse, PHP-like file placement, web-accessible PHP execution, credential-file access, CMS state manipulation, administrator or Super User change risk, outbound communication, hosted-content tampering, phishing or malware hosting, spam infrastructure, and persistence.

Operational Classification

Public-facing CMS exploitation, webshell execution, hosted-content integrity compromise, and abuse-infrastructure pathway.

Primary Function

Abuse exposed Joomla extension, editor, page-builder, media, profile, asset, icon, font, image, or AJAX upload behavior to move from unauthenticated public web requests into attacker-controlled file placement, PHP-like artifact execution, credential or configuration access, CMS state manipulation, outbound communication, hosted-content modification, phishing or malware hosting, spam infrastructure, or persistence, creating uncertainty around website integrity, credential exposure, containment completeness, and customer-facing trust.

S12 — Campaign or Activity Overview

Figure 2

Joomla extension exploitation activity model showing exposed public Joomla extension access, unauthenticated upload or import abuse, PHP-like artifact placement, web-accessible execution, credential or configuration access, outbound communication, CMS state change, hosted-content tampering, abuse infrastructure, and post-remediation containment validation.

This report assesses Joomla extension exploitation and unauthenticated PHP webshell execution as a durable behavior class rather than a single scanner wave, exploit string, public proof-of-concept, actor cluster, or website patch event. The activity pattern involves adversaries or automated infrastructure interacting with exposed Joomla extension functionality in ways that may create attacker-controlled upload state, executable file placement, webshell access, credential exposure, hosted-content compromise, or follow-on abuse through hosting, CMS, FTP, database, mail, or outbound infrastructure.

·        The activity is best understood as a public web trust, CMS integrity, credential exposure, and hosted-content abuse threat rather than a routine internet scan, generic Joomla error, isolated upload attempt, or standard vulnerability-management issue.

·        Adversaries may target Joomla sites supporting customer portals, public brand pages, partner access, lead generation, marketing operations, support workflows, e-commerce-adjacent activity, file distribution, regulated content, or business-critical web delivery.

·        The behavior may involve rare source infrastructure, cloud-hosted infrastructure, residential proxies, VPN providers, scanner infrastructure, unusual geographies, suspicious ASNs, rare user agents, multipart form submissions, archive uploads, abnormal request sizes, repeated failed-to-success patterns, abnormal status sequences, response-size deviations, or upload-handler errors.

·        The activity may remain limited to reconnaissance, malformed requests, failed upload attempts, vulnerable endpoint probing, abnormal response behavior, or extension error activity, or it may progress into PHP-like file placement, HTTP access to planted artifacts, web server process execution, sensitive-file access, administrator state changes, outbound communication, FTP activity, hosting-control activity, or hosted-content impact.

·        The activity becomes highest risk when suspicious Joomla behavior affects sites that provide customer-facing services, regulated information, partner workflows, public downloads, payment-adjacent experiences, executive communications, high-visibility brand pages, shared hosting, or multiple virtual hosts tied to common backend infrastructure.

·        Actor names, infrastructure references, exploit-attempt reporting, scanner fingerprints, vulnerable-extension labels, or CVE references may increase urgency, but they should enrich the report rather than replace local behavior-led evidence of suspicious request activity, PHP-like file placement, execution, credential access, CMS state change, outbound communication, or hosted-content impact.

S13 — Targets and Exposure Surface

The exposure surface includes public Joomla sites, customer-managed Joomla deployments, Joomla webroots, writable extension-owned paths, editor extensions, page-builder extensions, media managers, upload handlers, profile import functions, custom-icon upload functions, archive extraction behavior, AJAX upload paths, Joomla administrator state, Joomla configuration files, database credentials, FTP access, hosting-control workflows, and downstream services that rely on Joomla-hosted content or shared web infrastructure.

·        Internet-facing Joomla sites using editor, page-builder, media, asset, icon, font, profile, image, AJAX, library, upload, or component-owned extensions.

·        Joomla extension paths involving JCE profile import behavior, SP Page Builder custom-icon upload behavior, Page Builder CK upload behavior, generic media upload behavior, asset upload behavior, image upload behavior, and component-owned AJAX upload behavior where locally present.

·        Joomla writable and web-accessible directories, including media, images, tmp, cache, uploads, assets, iconfont, fonts, gfonts, templates, plugins, components, modules, libraries, backup directories, and extension-owned paths.

·        PHP, phtml, phar, PHP-like, mixed-case PHP, double-extension, archive-extracted, renamed, short-lived, or obfuscated files placed in Joomla writable paths or extension-owned webroot locations.

·        Joomla configuration and credential-bearing material, including configuration.php, database dumps, backup archives, environment files, FTP material, mail settings, API keys, deployment secrets, and reused credentials.

·        Joomla administrator and Super User state, CMS database records, editor profiles, page-builder asset state, media library state, upload policy state, extension configuration, templates, plugins, redirects, .htaccess rules, mail scripts, cron entries, scheduled tasks, and content records.

·        Hosting and access workflows, including FTP, file manager, hosting-control panel access, backup and restore jobs, webroot integrity baselines, malware scanning, deployment workflows, and hosting-provider support activity.

·        Network and abuse infrastructure surrounding exposed Joomla hosts, including DNS, proxy, firewall, outbound HTTP or HTTPS, raw-IP communication, paste-site access, file-sharing access, SMTP behavior, command-and-control-like communication, spam infrastructure, and suspicious third-party destinations.

·        Environments with incomplete Joomla asset inventory, unknown extension usage, weak query-string retention, limited webroot monitoring, incomplete administrator baselines, weak outbound visibility, shared hosting constraints, incomplete FTP or hosting-control records, inconsistent backup comparison, or insufficient hosted-content review.

S14 — Sectors / Countries Affected

Sectors Affected

·        Retail, e-commerce-adjacent, hospitality, travel, and customer-facing service organizations.

·        Healthcare, life sciences, education, nonprofit, and public-sector organizations using Joomla for portals, public communications, content delivery, or departmental services.

·        Financial services, insurance, legal, professional services, consulting, and business-services organizations with Joomla-hosted public content, customer-facing pages, or partner-facing workflows.

·        Technology, software, SaaS, media, marketing, telecommunications, and digital-services organizations with high-visibility web properties or externally reachable content infrastructure.

·        Manufacturing, industrial, logistics, energy, utilities, and supplier-dependent organizations using Joomla for corporate sites, partner portals, documentation, support pages, or regional web properties.

·        Small and mid-sized enterprises, distributed organizations, franchise models, local governments, associations, and organizations with limited web security staffing or heavy reliance on hosting providers.

·        Organizations using Joomla extensions for editor workflows, page-builder functionality, media management, image upload, asset upload, icon or font handling, profile import, AJAX upload behavior, customer-facing content publishing, public downloads, or partner communication.

Countries Affected

·        Global.

·        Exposure is not limited to a single country or region because Joomla is deployed globally across enterprise, public-sector, education, healthcare, nonprofit, retail, technology, professional-services, and small-business environments.

·        Countries with large populations of public Joomla sites, high shared-hosting usage, distributed web administration, public-sector Joomla adoption, local-service web portals, or limited managed security coverage may face elevated operational exposure.

·        Country-specific impact should be assessed by Joomla asset exposure, extension usage, vulnerable or weakly controlled upload behavior, public web dependency, hosted-content sensitivity, credential reuse, hosting model, telemetry availability, regulatory obligations, and incident-response maturity rather than geography alone.

S15 — Adversary Capability Profiling

Capability Level

Moderate

Technical Sophistication

Adversaries require enough technical capability to identify public Joomla sites, recognize exposed extension routes, interact with upload, import, asset, profile, media, image, custom-icon, or AJAX handling behavior, and determine whether uploaded or extracted PHP-like content can be reached through the web. Lower-complexity activity may involve broad scanning, exploit replay, commodity proof-of-concept use, automated POST activity, public webshell payloads, source rotation, or opportunistic probing of known Joomla extension paths. Higher-capability activity may involve selective targeting of high-value Joomla sites, custom request shaping, archive extraction manipulation, file-extension bypass attempts, mixed-case PHP placement, double-extension payloads, webshell staging, cleanup, credential-file review, CMS state manipulation, rare outbound communication, and multi-site follow-on activity.

Infrastructure Maturity

Moderate

Infrastructure maturity varies by activity pattern. Lower-maturity activity may rely on direct scanning, cloud-hosted infrastructure, common VPS nodes, VPN providers, known scanner infrastructure, commodity webshells, public exploit tooling, and basic callback infrastructure. Higher-maturity activity may use rotating infrastructure, residential proxies, compromised hosts, trusted geographies, segmented probing, low-and-slow request timing, separate upload and access sources, staged outbound destinations, abuse-resistant hosting, and infrastructure designed to blend with normal Joomla administration, hosting-provider support, vulnerability validation, media upload, or web maintenance activity.

Operational Scale

Single public Joomla site to multi-site web infrastructure exposure

Operational scale ranges from suspicious activity against one exposed Joomla site to broader enterprise exposure when multiple Joomla properties, virtual hosts, shared hosting accounts, backend web servers, databases, FTP accounts, administrator credentials, templates, plugins, or deployment workflows are connected. Within one organization, scale can expand from one vulnerable extension path to credential exposure, administrator state changes, webroot persistence, malicious redirects, phishing pages, malware hosting, spam infrastructure, partner workflow exposure, customer-facing content impact, and post-remediation containment validation.

Escalation Likelihood

Moderate to High

Escalation likelihood is moderate to high when suspicious Joomla extension upload or import activity is followed by PHP-like file placement, HTTP access to the planted artifact, web server service-context execution, configuration-file access, database dump activity, administrator or Super User changes, outbound communication, FTP activity, hosting-control activity, hosted-content tampering, or post-remediation activity. Escalation likelihood increases when affected sites support customer portals, regulated content, partner workflows, public downloads, e-commerce-adjacent experiences, executive communications, high-traffic pages, shared hosting, reused credentials, weak file monitoring, incomplete web records, or limited hosting-provider visibility.

S16 — Targeting Probability Assessment

Overall Targeting Probability

High

Targeting Drivers

·        Joomla sites are commonly exposed to the public internet and may support customer-facing, partner-facing, brand-sensitive, and business-relevant web workflows.

·        Joomla extension upload, import, media, image, asset, custom-icon, profile, and AJAX functionality creates attractive targeting opportunities when weakly controlled behavior can write files into web-accessible paths.

·        Public exploit knowledge, repeatable extension paths, commodity scanning, and automated exploitation can lower the barrier for opportunistic adversaries.

·        PHP-like file placement in writable Joomla paths can provide a direct path to webshell execution, credential access, hosted-content tampering, outbound communication, and persistence without first compromising an employee endpoint.

·        Attackers benefit from environments where Joomla asset inventory, extension inventory, query-string retention, webroot integrity monitoring, file telemetry, endpoint visibility, outbound monitoring, FTP logs, hosting-control records, and backup comparison data are incomplete.

·        Shared hosting, managed hosting, multiple virtual hosts, reused credentials, unclear administrator ownership, weak extension governance, and inconsistent maintenance practices can make compromise harder to scope quickly.

·        Normal Joomla administration, extension updates, template changes, media uploads, backups, migrations, vulnerability validation, hosting-provider support, emergency remediation, and malware cleanup can make attacker-driven activity harder to classify without strong baselines.

·        Targeting probability should be assessed through Joomla internet exposure, extension usage, upload behavior, writable-path controls, PHP execution restrictions, hosted-content sensitivity, credential reuse, telemetry maturity, and local evidence of upload-to-impact behavior rather than actor names or scanner labels alone.

Most Likely Targets

·        Internet-facing Joomla sites using editor, page-builder, media, asset, icon, font, profile, image, AJAX, library, upload, or component-owned extensions.

·        Joomla deployments with JCE profile import behavior, SP Page Builder custom-icon upload behavior, Page Builder CK upload behavior, generic media upload behavior, page-builder asset upload behavior, or component-owned AJAX upload behavior where exposed.

·        Joomla writable paths and extension-owned directories, including media, images, tmp, cache, uploads, assets, iconfont, fonts, gfonts, templates, plugins, components, modules, libraries, and backup locations.

·        Customer portals, partner-facing sites, support pages, public downloads, marketing sites, campaign pages, high-traffic brand pages, e-commerce-adjacent workflows, regulated content pages, and regional or departmental web properties.

·        Joomla administrator accounts, Super User accounts, configuration.php, database credentials, database dumps, backup files, FTP material, mail settings, API keys, deployment secrets, templates, plugins, redirects, .htaccess rules, mail scripts, and scheduled tasks.

·        Organizations with public Joomla exposure, incomplete extension inventory, delayed patching, weak upload controls, writable-path PHP execution, limited webroot monitoring, incomplete web records, shared hosting constraints, reused credentials, weak outbound visibility, or incomplete FTP and hosting-control logging.

S17 — MITRE ATT&CK Chain Flow Mapping

Stage 1 — Public-Facing Joomla Site Discovery

The adversary identifies exposed Joomla sites and prioritizes targets that appear to run vulnerable or weakly controlled editor, page-builder, media, asset, profile, image, upload, or AJAX-capable extensions.

·        T1595 — Active Scanning.

Stage 2 — Joomla Extension Upload or Import Exploitation

The adversary sends unauthenticated, unusual, malformed, repeated, or automation-like requests against exposed Joomla extension upload, import, profile, custom-icon, asset, media, image, or AJAX behavior to gain attacker-controlled upload state or write access.

·        T1190 — Exploit Public-Facing Application.

Stage 3 — PHP Webshell Placement, Execution, and Persistence

The adversary places a PHP-like artifact in a web-accessible Joomla path, accesses it through the web server, and uses the webshell or related PHP artifact to execute attacker-controlled functionality or preserve access.

·        T1505.003 — Server Software Component: Web Shell.

Stage 4 — Credential and Configuration Access

The adversary uses the webshell or compromised Joomla context to access configuration files, database credentials, backup material, FTP material, mail settings, API keys, or other credential-bearing data.

·        T1552 — Unsecured Credentials.

Stage 5 — Hosted-Content Impact

The adversary causes visible or business-impacting website abuse through hosted-content tampering, injected redirects, phishing pages, malware hosting, spam infrastructure, SEO poisoning, or customer-facing integrity impact.

·        T1491 — Defacement

S18 — Attack Path Narrative (Signal-Aligned Execution Flow)

Joomla extension exploitation and unauthenticated PHP webshell execution begins when adversaries identify exposed Joomla sites that use editor, page-builder, media, image, asset, profile, custom-icon, upload, archive extraction, or AJAX-capable extensions. The attacker’s objective is to move from suspicious public Joomla extension access into attacker-controlled upload state, PHP-like artifact placement, web-accessible execution, credential or configuration access, CMS state manipulation, outbound communication, hosted-content tampering, abuse infrastructure, or persistence. The attack path is defined by public Joomla site discovery, exposed extension upload or import abuse, PHP-like file placement, web-accessible PHP execution, credential and configuration access, CMS state manipulation, outbound communication, hosted-content abuse, and post-remediation containment validation. Broader lateral movement, ransomware deployment, endpoint compromise, cloud compromise, or large-scale data theft should be treated as conditional amplification unless supporting telemetry confirms those behaviors.

Stage 1: Public-Facing Joomla Site Discovery

The adversary identifies exposed Joomla sites and prioritizes deployments that appear to use editor, page-builder, media, asset, image, icon, font, profile, upload, library, archive extraction, or AJAX-capable extensions. This may involve internet scanning, repeated Joomla path access, extension fingerprinting, source-infrastructure rotation, cloud-hosted infrastructure, VPN providers, residential proxies, scanner infrastructure, unusual geographies, suspicious ASNs, or probing of known component-owned routes. This stage is not sufficient by itself to establish compromise because public Joomla sites are routinely scanned. It becomes material when discovery activity aligns with exposed Joomla assets, vulnerable or weakly controlled extension behavior, abnormal request timing, repeated upload-path access, unusual response patterns, or later evidence of file placement.

Stage 2: Joomla Extension Upload or Import Abuse

The adversary sends unauthenticated, malformed, repeated, unusual, or automation-like requests against Joomla extension upload, import, profile, custom-icon, asset, media, image, archive extraction, or AJAX handling behavior. Observable evidence may include multipart form submissions, archive uploads, abnormal request sizes, rare user agents, unusual parameter names, repeated failed-to-success sequences, abnormal status-code patterns, response-size deviations, upload-handler errors, extension-specific route access, or unexpected write activity in component-owned paths. This stage changes the event from routine exposure into possible exploitation when suspicious request behavior aligns with attacker-controlled upload state, unexpected file creation, writable-path activity, or extension behavior that can place files in web-accessible locations.

Stage 3: PHP-Like Artifact Placement

The adversary places or causes the placement of a PHP-like artifact in a Joomla webroot, writable directory, extension-owned path, extracted archive location, media path, image path, template path, plugin path, module path, cache path, tmp path, asset path, iconfont path, gfonts path, upload path, or other web-accessible location. Observable evidence may include new or modified PHP, phtml, phar, mixed-case PHP, double-extension, archive-extracted, renamed, short-lived, or obfuscated files in directories that should normally contain images, fonts, static assets, media files, temporary files, or extension-controlled content. This stage becomes materially significant when suspicious Joomla requests align with PHP-like file creation, unexpected file ownership, abnormal timestamps, unusual permissions, recently modified webroot content, or files that differ from known-good backup state.

Stage 4: Web-Accessible PHP Execution

The adversary accesses the planted artifact through the web server and attempts to execute attacker-controlled functionality in the Joomla host context. Observable evidence may include HTTP access to newly created files, unusual query strings, POST activity to PHP-like artifacts, command-like parameters, abnormal response sizes, repeated access to short-lived files, web server process anomalies, service-context execution, child process activity where visible, crash or fault behavior, or follow-on requests that suggest webshell interaction. This stage is the key execution point because the event moves from suspicious upload behavior into possible attacker-controlled server-side execution.

Stage 5: Credential and Configuration Access

The adversary uses the webshell, planted PHP artifact, or compromised Joomla context to access configuration files, database credentials, backup material, database dumps, FTP material, mail settings, API keys, deployment secrets, environment files, reused credentials, or other credential-bearing data. Observable evidence may include access to configuration.php, backup archives, database export files, unusual file reads, database connection activity, file-manager activity, unexpected downloads, credential rotation triggers, or host activity that aligns with sensitive-file access after suspicious Joomla behavior. This stage increases business risk because credential exposure can extend the incident beyond the vulnerable extension and into databases, hosting workflows, FTP access, mail infrastructure, administrator access, or adjacent web properties.

Stage 6: CMS State Manipulation and Administrator Exposure

The adversary manipulates or abuses Joomla CMS state, administrator accounts, Super User accounts, extension configuration, editor profiles, page-builder assets, templates, plugins, redirects, .htaccess rules, mail scripts, cron entries, scheduled tasks, media library state, upload policy state, or content records. Observable evidence may include new or modified administrators, Super User changes, abnormal login activity, unexpected extension changes, suspicious template edits, unauthorized redirect changes, unusual plugin or module state, modified access-control settings, unknown scheduled tasks, or content changes that do not match approved administration. This stage becomes materially significant when CMS changes occur after suspicious extension activity and cannot be tied to approved maintenance, emergency remediation, hosting-provider support, vulnerability validation, or incident-response activity.

Stage 7: Outbound Communication and Abuse Infrastructure

The adversary uses the Joomla host for outbound communication, staging, callback activity, spam scripts, phishing support, malware hosting, file retrieval, paste-site access, raw-IP communication, suspicious HTTP or HTTPS destinations, SMTP behavior, or infrastructure that supports broader abuse. Observable evidence may include rare outbound destinations, unusual DNS lookups, raw-IP HTTP requests, paste-site access, file-sharing access, abnormal SMTP activity, web server initiated connections, suspicious third-party destinations, firewall alerts, proxy alerts, abuse-provider notifications, or traffic that deviates from normal Joomla, hosting-provider, update, plugin, CDN, analytics, mail, or administrative behavior. This stage increases exposure because the affected Joomla host may become part of adversary infrastructure even when visible hosted content appears normal.

Stage 8: Hosted-Content Impact and Post-Remediation Containment Risk

The adversary causes visible or business-impacting abuse through hosted-content tampering, injected redirects, phishing pages, malware hosting, spam infrastructure, SEO poisoning, unauthorized file distribution, customer-facing integrity impact, or continued access after remediation. Observable evidence may include modified pages, unexpected redirects, suspicious landing pages, unknown files, browser warnings, search-engine warnings, abuse-desk complaints, customer reports, partner reports, malware scan detections, changed templates, altered .htaccess rules, unauthorized scripts, or post-remediation access to suspicious files. This stage becomes high priority when activity continues after extension remediation, file cleanup, credential rotation, PHP execution restriction, administrator review, hosting-provider coordination, or content restoration.

S19 — Attack Chain Risk Amplification Summary

Joomla extension exploitation and unauthenticated PHP webshell execution amplifies risk because it targets public web infrastructure that may concentrate brand trust, customer-facing content, partner workflows, support services, file distribution, marketing operations, e-commerce-adjacent activity, regulated content, administrator access, database credentials, FTP access, mail settings, hosting-control workflows, and shared web infrastructure. The chain becomes materially more dangerous when suspicious Joomla extension activity is followed by PHP-like file placement, HTTP access to planted artifacts, web server service-context execution, credential-file access, CMS state manipulation, administrator or Super User changes, outbound communication, hosted-content tampering, abuse infrastructure, or access that continues after remediation.

·        Internet-facing Joomla exposure increases risk because the site may be reachable from adversary-controlled infrastructure, scanner infrastructure, cloud-hosted sources, VPN providers, residential proxies, or compromised hosts.

·        Extension upload and import behavior increases exposure because vulnerable or weakly controlled functionality may allow attacker-controlled content to reach web-accessible Joomla paths.

·        PHP-like file placement increases risk because compromise may move directly from public web requests into server-side execution without first requiring employee endpoint compromise.

·        Webshell execution becomes materially significant when HTTP access to newly created files aligns with suspicious Joomla requests, web server process activity, command-like parameters, abnormal response behavior, sensitive-file access, outbound communication, or persistence.

·        Credential and configuration access amplifies business impact when exposed material includes configuration.php, database credentials, database dumps, backup archives, FTP material, mail settings, API keys, deployment secrets, administrator credentials, or reused credentials.

·        CMS state manipulation increases risk when Joomla administrator accounts, Super User accounts, extension configuration, templates, plugins, redirects, .htaccess rules, mail scripts, cron entries, scheduled tasks, page-builder assets, or content records change after suspicious extension activity.

·        Hosted-content tampering amplifies business exposure when affected pages support customer portals, partner workflows, regulated content, payment-adjacent experiences, public downloads, support portals, executive communications, marketing campaigns, or high-visibility brand pages.

·        Abuse-infrastructure activity increases concern when the Joomla host is used for phishing pages, malware hosting, spam infrastructure, SEO poisoning, suspicious redirects, raw-IP communication, paste-site access, file-sharing access, or command-and-control-like communication.

·        Shared hosting and multi-site web infrastructure increase scope because one compromised Joomla instance may expose shared credentials, shared databases, shared virtual hosts, common deployment workflows, FTP accounts, backup locations, or adjacent web properties.

·        Post-remediation activity becomes a high-priority containment signal when suspicious file access, outbound communication, administrator changes, hosted-content tampering, FTP activity, hosting-control activity, or abuse reports continue after extension remediation, file cleanup, credential rotation, or PHP execution restriction.

·        Business exposure increases when affected Joomla sites support customer-facing services, partner access, regulated information, lead generation, e-commerce-adjacent workflows, public downloads, executive communications, regional sites, departmental services, or high-traffic public web properties.

·        Incomplete WAF records, reverse-proxy records, CDN records, load-balancer records, web access records, query strings, Joomla administrative records, CMS database records, file telemetry, endpoint telemetry, DNS records, proxy records, firewall records, FTP records, hosting-control records, backup comparison data, malware scan results, or abuse-desk records can force broader investigation because the organization cannot quickly prove whether webshell execution or hosted-content impact occurred.

·        Response burden increases because teams must validate Joomla asset exposure, extension inventory, vulnerable upload behavior, writable-path controls, PHP execution restrictions, suspicious request activity, file placement, webshell access, credential exposure, administrator state, outbound communication, FTP activity, hosting-control activity, hosted-content integrity, abuse complaints, legal obligations, and executive assurance.

S20 — Tactics, Techniques, and Procedures

Figure 3

Joomla extension exploitation attack-chain model showing public-facing Joomla site discovery, exposed extension upload or import abuse, PHP-like artifact placement, web-accessible PHP execution, credential or configuration access, CMS state manipulation, outbound communication, hosted-content impact, and post-remediation containment validation.

Public-Facing Joomla Site Discovery

Adversaries may identify exposed Joomla sites through internet scanning, repeated Joomla path access, extension fingerprinting, source-infrastructure rotation, cloud-hosted infrastructure, VPN providers, residential proxies, suspicious ASNs, unusual geographies, scanner infrastructure, or probing of component-owned routes. This behavior becomes risk-relevant when exposed Joomla sites use editor, page-builder, media, image, asset, profile, icon, font, upload, library, archive extraction, or AJAX-capable extensions and the activity aligns with later abnormal request behavior, extension route access, or file placement.

Joomla Extension Upload or Import Abuse

Adversaries may send malformed, unusual, repeated, or automation-like requests against Joomla extension upload, import, profile, custom-icon, asset, media, image, archive extraction, or AJAX handling behavior. This behavior becomes high priority when it aligns with multipart form submissions, archive uploads, unusual parameter use, abnormal request sizes, rare user agents, repeated failed-to-success sequences, abnormal status codes, response-size deviations, upload-handler errors, unexpected write activity, or extension-owned paths that can place content in web-accessible locations.

PHP-Like Artifact Placement

Adversaries may place PHP, phtml, phar, PHP-like, mixed-case PHP, double-extension, archive-extracted, renamed, short-lived, or obfuscated files in Joomla writable directories or extension-owned webroot locations. This behavior becomes materially significant when suspicious Joomla requests align with file creation or modification in media, images, tmp, cache, uploads, assets, iconfont, fonts, gfonts, templates, plugins, components, modules, libraries, backup directories, or other paths where executable PHP content should not normally appear.

Web-Accessible PHP Execution

Adversaries may access planted PHP-like artifacts through the web server and use them to execute attacker-controlled functionality in the Joomla host context. This behavior becomes high risk when access to newly created files includes POST activity, unusual query strings, command-like parameters, repeated access to short-lived artifacts, abnormal response sizes, service-context execution, child process activity where visible, web server faults, crash behavior, or follow-on activity that suggests webshell interaction.

Credential and Configuration Access

Adversaries may use webshell access, planted PHP artifacts, or compromised Joomla context to access configuration files, database credentials, database dumps, backup archives, FTP material, mail settings, API keys, deployment secrets, environment files, reused credentials, or administrator credential material. This behavior becomes materially significant when sensitive-file access follows suspicious Joomla extension activity and cannot be explained by approved maintenance, hosting-provider support, malware cleanup, backup activity, vulnerability validation, or documented incident response.

CMS State Manipulation and Administrator Exposure

Adversaries may manipulate Joomla administrator accounts, Super User accounts, editor profiles, page-builder assets, media library state, upload policy state, extension configuration, templates, plugins, redirects, .htaccess rules, mail scripts, cron entries, scheduled tasks, or content records. This behavior becomes high risk when CMS state changes follow suspicious extension activity and involve unknown administrators, privilege changes, unauthorized extension changes, suspicious template edits, redirect manipulation, modified access-control settings, or content changes outside approved administrative baselines.

Outbound Communication and Abuse Infrastructure

Adversaries may use the Joomla host for outbound communication, callback activity, staging, file retrieval, paste-site access, file-sharing access, raw-IP communication, suspicious HTTP or HTTPS destinations, SMTP behavior, spam scripts, phishing support, malware hosting, or other abuse infrastructure. This behavior becomes high risk when outbound communication follows suspicious upload or webshell activity, reaches rare destinations, uses unfamiliar infrastructure, deviates from normal Joomla update or plugin behavior, triggers proxy or firewall alerts, creates abuse-provider complaints, or cannot be tied to approved hosting-provider, CDN, analytics, mail, administrative, or maintenance workflows.

Hosted-Content Tampering and Abuse

Adversaries may alter hosted content, inject redirects, create phishing pages, stage malware, host unauthorized files, modify templates, alter .htaccess rules, insert suspicious scripts, support spam infrastructure, or conduct SEO poisoning from the affected Joomla site. This behavior becomes materially significant when altered content affects customer portals, partner workflows, regulated content, payment-adjacent pages, public downloads, support portals, executive communications, marketing campaigns, high-visibility brand pages, or pages that customers and partners directly trust.

Operational Blending With Joomla Administration and Hosting Workflows

Adversaries may blend malicious activity into normal Joomla administration, extension updates, media uploads, template changes, backups, migrations, vulnerability validation, hosting-provider support, malware scanning, emergency remediation, file-manager activity, or incident-response cleanup. This blending is effective because Joomla environments often generate legitimate upload activity, file changes, administrator changes, extension modifications, redirects, template edits, backup artifacts, and hosting-provider actions. Detection and response require correlating request behavior, file placement, execution indicators, CMS state, outbound communication, hosting-control activity, administrator context, and hosted-content impact rather than relying on one artifact in isolation.

Post-Remediation Access and Containment Failure

Adversaries may continue accessing planted files, webshells, modified CMS state, administrator accounts, outbound infrastructure, FTP workflows, hosting-control paths, or hosted-content abuse after extension remediation, file cleanup, PHP execution restrictions, credential rotation, administrator review, hosting-provider coordination, or content restoration. This behavior becomes high priority when access continues after remediation, originates from suspicious source infrastructure, touches suspicious PHP-like artifacts, reaches sensitive files, triggers outbound communication, modifies hosted content, causes abuse complaints, or cannot be tied to approved business, hosting-provider, or incident-response activity.

S20A — Adversary Tradecraft Summary

Joomla extension exploitation and unauthenticated PHP webshell execution targets the trust relationship between exposed Joomla extension functionality, writable web-accessible paths, PHP execution, administrator state, credential material, hosted content, outbound communication, hosting workflows, and customer-facing web integrity. The adversary objective is to convert public extension access into attacker-controlled file placement, executable PHP behavior, credential exposure, CMS manipulation, hosted-content abuse, or containment uncertainty while blending into normal Joomla administration and hosting-provider activity.

·        The core tradecraft pattern is suspicious Joomla extension activity followed by attacker-controlled upload state, PHP-like file placement, HTTP access to planted artifacts, web-accessible execution, credential or configuration access, CMS state manipulation, outbound communication, hosted-content tampering, abuse infrastructure, or post-remediation activity.

·        The behavior is not dependent on a single exploit string, actor name, scanner fingerprint, request path, source IP, user agent, extension label, filename, payload, response code, vulnerable-version finding, proof-of-concept reference, or static IOC.

·        Adversaries may use internet scanning, source rotation, cloud-hosted infrastructure, VPN providers, residential proxies, malformed upload requests, multipart form submissions, archive uploads, profile import abuse, custom-icon upload abuse, page-builder upload abuse, AJAX upload abuse, PHP-like file placement, webshell interaction, credential-file access, redirect manipulation, phishing pages, malware hosting, spam infrastructure, and post-remediation access.

·        The strongest operational risk occurs when suspicious activity affects Joomla sites that support customer portals, partner workflows, regulated content, payment-adjacent experiences, public downloads, support portals, executive communications, high-traffic brand pages, shared hosting, reused credentials, or multiple web properties tied to common backend infrastructure.

·        Detection requires visibility into the Joomla request behavior that begins the chain and the file, execution, CMS state, administrator, outbound, FTP, hosting-control, backup, abuse-desk, and hosted-content evidence that confirms or disproves impact.

·        Response requires treating suspected Joomla extension exploitation as a public web trust, credential exposure, CMS integrity, hosted-content abuse, and containment-validation incident, not a routine scanner alert, isolated Joomla error, single vulnerable-extension finding, or patch-management task.

·        The behavior remains durable because the adversary objective is to convert exposed Joomla extension trust into executable web-accessible content, credential exposure, hosted-content manipulation, abuse infrastructure, or containment uncertainty regardless of the specific source infrastructure, upload route, extension name, scanner label, exploit variant, or campaign branding used.

S21 — Detection Strategy Overview

Detection Philosophy

Detect Joomla extension upload abuse through correlated behavior across web, application, file, endpoint, and outbound telemetry, not through CVE names, KEV status, single request strings, exploit proof-of-concept names, scanner hits, or vulnerable-version status alone. The durable detection model is unauthenticated Joomla extension endpoint abuse followed by attacker-controlled upload or profile state, PHP-like file placement in a web-accessible path, HTTP access to the planted file, web server service-context execution, credential or configuration access, outbound communication, hosted-content modification, or persistence.

Primary Detection Anchors

·        Suspicious unauthenticated or unusual POST activity against Joomla extension endpoints associated with editor profile import, custom icon upload, page-builder upload, asset upload, media import, image upload, or AJAX upload behavior.

·        Requests involving option=com_jce and task=profiles.import.

·        Requests involving option=com_sppagebuilder and task=asset.uploadCustomIcon.

·        Requests involving Page Builder CK upload behavior, including browse.ajaxAddPicture, page-builder image upload, media upload, or component-owned AJAX upload behavior where locally observable.

·        New or modified Joomla editor, page-builder, media, icon, font, library, or upload state outside approved administrative activity.

·        PHP, phtml, phar, PHP-like, double-extension, mixed-case PHP, archive-extracted PHP, or obfuscated PHP artifacts in Joomla writable or web-accessible paths.

·        HTTP GET or POST access to newly created PHP-like files under Joomla media, images, tmp, cache, uploads, assets, iconfont, gfonts, templates, plugins, components, modules, or extension-owned directories.

·        Web server service-context execution involving shell, scripting, transfer, archive, encoding, database, discovery, credential-access, or outbound network tooling.

·        Access to Joomla configuration.php, database dumps, backup files, environment files, FTP material, mail settings, API keys, or other credential-bearing files after suspicious upload or PHP access.

·        Rare outbound DNS, proxy, firewall, EDR, or hosting-provider network activity from Joomla hosts after suspicious upload, PHP access, file creation, or web server process execution.

·        Joomla administrator, Super User, template, plugin, redirect, mail script, scheduled task, cron, .htaccess, file-manager, FTP, hosting-control, or backup changes near suspicious web activity.

·        Hosted-content tampering, injected redirects, phishing pages, malware hosting, spam infrastructure, SEO poisoning, abuse complaints, or customer-facing integrity changes.

Detection Prioritization Model

Prioritize activity where Joomla extension upload or profile/import behavior is followed within a bounded time window by PHP-like file placement, HTTP access to that file, web server process execution, sensitive-file access, outbound communication, administrator or Super User creation, FTP or hosting-control changes, or hosted-content modification. Treat request telemetry alone as exposure or exploit-attempt evidence unless it is joined to file, process, CMS state, outbound, credential, hosting-control, or content-impact evidence.

Correlation Strategy (Strict Enforcement)

Do not promote a single Joomla extension request, a single PHP file, one upload attempt, a vulnerable-version finding, KEV presence, public exploit availability, scanner traffic, or generic web error activity to high-confidence compromise without correlation by Joomla asset, virtual host, backend host, source IP, forwarded source IP, request path, query string, uploaded path, file timestamp, file owner, process lineage, CMS user, extension state, destination, maintenance window, or time window. High-confidence detection requires a sequence that connects public Joomla extension access to PHP placement, execution, host behavior, credential access, outbound communication, persistence, or website integrity impact.

Telemetry Prioritization

Prioritize URI-preserving web access logs, WAF logs, reverse-proxy logs, CDN logs, load-balancer logs, Joomla administrative audit logs, Joomla database change records, extension configuration state, file-integrity telemetry, EDR or Linux audit telemetry, process creation telemetry, command-line telemetry, DNS logs, proxy logs, firewall logs, FTP logs, file-manager logs, hosting-control logs, backup and restore logs, database access logs, mail logs, abuse-desk records, and asset inventory. Query-string preservation is mandatory for strong request-side detection.

Detection Design Constraints

Avoid detection designs based only on CVE identifiers, KEV status, vulnerability scanner output, isolated endpoint names, proof-of-concept repository names, single exploit strings, public user agents, IP addresses, file hashes, or one webshell filename. Detection must remain useful across extension-specific variants that differ in route, task name, upload handler, archive extraction behavior, writable path, file extension case, payload name, and post-exploitation sequence.

Baseline and Deployment Requirements

Baseline approved Joomla administrators, administrator source networks, hosting-provider support sources, vulnerability scanners, patch-validation tools, maintenance windows, deployment users, CI/CD workflows, FTP users, file-manager users, backup and restore jobs, approved Joomla extensions, approved writable paths, approved PHP paths, approved icon/font/media upload behavior, approved template and plugin changes, approved outbound destinations, and normal Joomla update activity. Validate virtual-host-to-backend-host mapping before promoting correlation logic to alert mode.

Variant Resilience Requirements

Rules should remain effective for future Joomla, CMS extension, editor, page-builder, media-manager, upload-handler, or profile/configuration abuse paths that produce the same operational behavior: unauthenticated extension access, attacker-controlled upload or profile state, executable upload enablement, PHP-like file placement, web-accessible execution, web server service-context behavior, credential exposure, rare egress, persistence, hosted-content tampering, or abuse infrastructure.

Operational Detection Model

Run detections in hunt mode first, validate request parsing, confirm query-string retention, tune approved sources, validate joins between web and host telemetry, baseline normal Joomla extension administration, verify file path normalization, test case-insensitive PHP matching, confirm writable-path inventory, and then promote to alert mode. Use escalating confidence: suspicious request, suspicious request plus writable-path PHP access, suspicious request plus file creation, suspicious request plus endpoint execution, and suspicious request plus credential, egress, hosting-control, or content-impact evidence.

Explicit Non-Deployment Guardrails

Do not deploy weak WAF-only request rules as compromise detection. Do not claim webshell execution from vulnerable-version status alone. Do not claim confirmed compromise from scanner traffic, generic Joomla probing, common PHP paths, unrelated PHP files, cloud-only anomalies, identity-only anomalies, or network-only anomalies. Do not attribute FTP, hosting-control, cloud, database, email, or identity activity to Joomla extension compromise without Joomla asset, source, path, file, process, identity, extension state, or time-window linkage.

S22 — Primary Detection Signals

Figure 4

Primary Detection Signals

·        Unauthenticated, external, unusual, or non-administrative POST requests to Joomla extension upload, import, profile, custom-icon, asset, media, image, library, or AJAX endpoints.

·        Requests involving option=com_jce and task=profiles.import.

·        Requests involving option=com_sppagebuilder and task=asset.uploadCustomIcon.

·        Requests involving Page Builder CK upload behavior, including browse.ajaxAddPicture, component-owned image upload, media upload, gfonts path population, or AJAX upload behavior where locally visible.

·        Archive upload, extraction, or file-write behavior followed by new files under Joomla extension-owned media, iconfont, fonts, gfonts, assets, images, uploads, tmp, cache, templates, plugins, components, or modules paths.

·        New, modified, renamed, or recently accessed PHP, phtml, phar, PHP-like, mixed-case PHP, double-extension, or obfuscated PHP files in writable Joomla paths.

·        HTTP GET or POST access to newly created PHP-like files in Joomla writable or extension-owned directories.

·        Web server service account spawning shell, scripting, transfer, archive, discovery, credential-access, database, encoding, or network tools.

·        Access to Joomla configuration.php, backup files, database dumps, environment files, mail configuration, FTP material, API keys, or credential-bearing files after suspicious upload or PHP access.

·        New Joomla administrator or Super User accounts, modified templates, plugin changes, redirect changes, .htaccess changes, mail scripts, or unexpected CMS content updates near suspicious upload activity.

·        Rare outbound DNS, proxy, firewall, or EDR network activity from Joomla hosts after suspicious upload, PHP placement, or PHP access.

Supporting Detection Signals

·        Unusual user agents, request sizes, archive names, content types, multipart form submissions, response sizes, response status patterns, or repeated attempts around Joomla extension upload endpoints.

·        HTTP 200, 206, 302, 403, 404, or 500 response sequences around upload, extraction, PHP access, or webshell interaction attempts.

·        Scanner-like activity followed by successful upload, archive extraction, writable-path PHP access, or endpoint process behavior.

·        File owner, permission, timestamp, extension case, path, or naming patterns inconsistent with approved Joomla deployment behavior.

·        FTP, hosting-control, file-manager, database, mail, or backup activity near suspicious Joomla web events.

·        CMS database changes involving editor profiles, page-builder assets, media libraries, upload policy, extension configuration, template state, plugin state, or administrator state.

·        Abuse reports, spam complaints, suspicious redirects, malware hosting reports, SEO warnings, search-console alerts, or customer reports after suspicious Joomla web activity.

Exploit Attempt and Instability Signals

·        Repeated requests to Joomla editor, page-builder, custom-icon, asset, media, image, import, browse, or AJAX upload paths from external sources.

·        Failed-to-success upload patterns or repeated status-code transitions around the same Joomla extension path.

·        Upload attempts followed by archive extraction paths, random directory names, font or icon directories, media directories, gfonts paths, or component-owned asset paths.

·        Access to temporary files, extracted archive contents, PHP-like files with mixed-case extensions, double extensions, uncommon extensions, or encoded file names.

·        Web server errors, PHP warnings, upload-handler errors, file permission errors, or malformed archive handling near suspicious Joomla extension requests.

·        Short-lived PHP artifacts that are created, accessed, renamed, deleted, or replaced within a narrow window.

Outbound Communication Signals

·        DNS, proxy, firewall, EDR, or hosting-provider network activity from Joomla web servers to rare, newly seen, newly registered, suspicious, unknown, unapproved, or geographically unusual destinations after suspicious upload or PHP access.

·        Web server processes initiating outbound HTTP, HTTPS, DNS, SSH, SMTP, paste-site, file-sharing, raw-IP, or command-and-control-like communication.

·        Outbound connections temporally aligned with PHP file creation, PHP web access, suspicious process execution, credential-file access, or hosted-content modification.

·        Repeated callbacks from the same Joomla host after suspicious extension upload activity.

·        Network activity from shared-hosting or web-server accounts inconsistent with approved update, backup, monitoring, or hosting-provider activity.

Persistence and Post-Exploitation Signals (Conditional)

·        New or modified PHP files, phtml files, phar files, templates, plugins, modules, components, administrator accounts, Super User accounts, scheduled tasks, cron entries, hidden files, backup archives, redirects, .htaccess rules, mail scripts, or webshell variants.

·        Modified Joomla templates, plugin files, extension files, media assets, language files, cache files, or component-owned directories outside approved maintenance.

·        Rogue editor, page-builder, media, icon, font, library, profile, or upload configuration state that enables executable content or unexpected file placement.

·        Creation of backup archives, database dumps, file-manager artifacts, alternate shells, secondary uploaders, or staged tools after initial PHP access.

·        Cleanup attempts involving deletion of uploaded archives, removal of webshells, timestamp manipulation, log deletion, restoration of original content, or repeated file replacement.

Lateral Movement and Expansion Signals (Conditional)

·        Use of Joomla, database, FTP, hosting-control, SSH, mail, API, cloud workload, backup, or reused credentials against adjacent infrastructure after suspicious Joomla extension activity.

·        Database access, dump creation, authentication table review, password hash access, configuration-file reads, or credential reuse from the Joomla host.

·        Access to adjacent webroots, sibling virtual hosts, shared-hosting accounts, backup repositories, mail systems, storage buckets, CDN configuration, or deployment pipelines.

·        New outbound connections from the Joomla host to internal management, database, file-sharing, mail, or hosting-control services.

·        Multiple Joomla properties showing similar upload, PHP placement, webshell access, or hosted-content tampering patterns within a short time window.

Signal Usage Constraints

Do not treat any single signal as compromise confirmation. Promote confidence only when signals align by Joomla asset, extension, virtual host, backend host, source IP, forwarded source IP, URI path, query string, uploaded file path, file timestamp, file owner, process lineage, CMS user, destination, maintenance window, or bounded time window. Treat KEV status and public exploit availability as urgency inputs, not detection proof.

S23 — Telemetry Requirements

Endpoint and Process Execution Telemetry

·        EDR, Linux audit, Sysmon for Linux, auditd, hosting-agent, or equivalent process creation telemetry from Joomla hosts.

·        Parent process, child process, process user, command line, current directory, executable path, hash, timestamp, host, container, and virtual-host mapping.

·        Web server service account mapping for Apache, Nginx, LiteSpeed, OpenLiteSpeed, PHP-FPM, lsphp, php-cgi, cgi-fcgi, container runtimes, and hosting-provider service wrappers.

·        Detection of shell, scripting, transfer, archive, encoding, database, credential-access, discovery, network, and persistence tooling spawned from web server context.

·        Endpoint grouping for Joomla hosts, shared-hosting accounts, containerized Joomla workloads, and dedicated Joomla web servers.

·        Approved deployment-user, approved command, approved backup, approved migration, approved plugin update, approved vulnerability-validation, and approved hosting-provider exceptions.

Memory and Execution Telemetry

·        Web server service-context execution evidence where available.

·        PHP-FPM, CGI, LiteSpeed, Apache module, Nginx upstream, or container runtime execution context where available.

·        Runtime command execution, interpreter invocation, encoded command execution, child-process spawning, or unusual PHP-driven execution behavior.

·        Process lineage linking HTTP request handling, PHP execution, shell invocation, file access, transfer-tool use, or outbound connection behavior.

·        Memory telemetry is optional and should be treated as conditional enrichment, not a minimum requirement.

·        Runtime execution telemetry is strongly recommended but may be unavailable on shared hosting or managed Joomla environments.

Crash and Fault Telemetry

·        Web server error logs.

·        PHP error logs.

·        Application error logs.

·        WAF block, allow, anomaly, and violation logs.

·        Reverse-proxy and load-balancer status-code logs.

·        Joomla extension errors, upload-handler errors, archive extraction errors, permission errors, and malformed request errors.

·        HTTP 403, 404, 500, abnormal response-size, repeated retry, failed-to-success, and upload instability patterns around suspicious Joomla extension routes.

·        Hosting-provider suspension, malware scanner, resource-abuse, binary-execution, or abuse-desk events where available.

File and Persistence Telemetry

·        File creation, modification, rename, write, read, delete, permission, ownership, and timestamp telemetry for Joomla webroots.

·        Coverage for images, media, tmp, cache, uploads, assets, iconfont, fonts, gfonts, templates, plugins, modules, components, administrator, libraries, backup, and extension-owned directories.

·        Case-insensitive detection of .php, .phtml, .phar, PHP-like names, mixed-case PHP, double extensions, archive-extracted PHP, and obfuscated PHP artifacts.

·        Known-good webroot baseline.

·        Approved Joomla file inventory.

·        Approved template, plugin, component, module, icon, font, media, and deployment inventories.

·        CMS database change records for editor profiles, page-builder assets, upload policy, extension configuration, administrator accounts, templates, plugins, and content state.

·        Backup comparison data, file-manager logs, FTP logs, hosting-control logs, and malware scan results.

Network and Outbound Communication Telemetry

·        DNS logs.

·        Proxy logs.

·        Firewall logs.

·        EDR network telemetry.

·        NDR metadata where it can join to Joomla hosts.

·        Hosting-provider egress logs where available.

·        Destination domain, destination IP, destination port, protocol, process context where available, source host, source account, timestamp, action, and reputation enrichment.

·        Recently seen domain enrichment.

·        Newly registered domain enrichment.

·        Destination country and ASN enrichment where available.

·        Approved egress-destination lookup.

·        Approved hosting-provider destination lookup.

·        Approved update, backup, monitoring, CDN, payment, analytics, and mail destination lookups.

Web and Application Telemetry (Conditional Availability)

·        Web server access logs with URI path and query-string preservation.

·        WAF logs.

·        Reverse-proxy logs.

·        CDN logs.

·        Load-balancer logs.

·        HTTP method, URI path, query string, full URL, status code, response size, request size, user agent, source IP, forwarded source IP, virtual host, backend host, backend IP, timestamp, and action.

·        Joomla asset inventory.

·        Joomla extension inventory covering JCE, SP Page Builder, Page Builder CK, and other editor, page-builder, upload, media, icon, font, profile, or asset-management extensions.

·        Joomla administrative audit logs where available.

·        Joomla database change records where native audit logs are absent.

·        CMS user, administrator, Super User, session, plugin, template, content, media, and extension-state telemetry where available.

·        Web logs from shared-hosting control panels, hosting providers, or managed Joomla services where direct server logs are unavailable.

Telemetry Availability Requirements

·        Minimum viable coverage requires URI-preserving web, WAF, reverse-proxy, CDN, load-balancer, or server-side access logs plus Joomla asset and extension inventory.

·        Strong coverage requires web telemetry joined to file telemetry, endpoint process telemetry, CMS state, DNS/proxy logs, and approved-source lookups.

·        Highest confidence requires correlation across suspicious Joomla extension request activity, uploaded file path, file creation or modification, HTTP access to the file, web server service-context execution, sensitive-file access, rare egress, CMS state change, hosting-control activity, and hosted-content review.

·        Shared-hosting environments require compensating evidence from WAF logs, hosting-provider logs, file-system review, CMS database inspection, FTP logs, file-manager logs, malware scanning, backup comparison, and webroot integrity review.

·        Cloud-hosted Joomla environments require application-layer telemetry and host or workload telemetry; cloud control-plane logs alone are not sufficient.

Telemetry Limitations and Gaps

·        Web logs may rotate quickly.

·        Query strings may not be logged.

·        CDN, WAF, reverse-proxy, and load-balancer logs may hide backend host identity without mapping.

·        Shared hosting may not expose process, memory, file, or network telemetry.

·        Joomla administrative audit logging may be absent or extension-dependent.

·        CMS profile, upload-policy, page-builder, icon, font, media, and extension state may require database inspection rather than native audit logs.

·        File timestamps may be unreliable after restore, migration, backup extraction, attacker modification, or cleanup.

·        PHP execution restrictions vary by host, directory, web server, PHP handler, and hosting provider.

·        Endpoint telemetry may be unavailable on commodity web hosting.

·        Cloud logs alone cannot prove Joomla extension exploitation, PHP upload, webshell execution, or website integrity impact.

·        Vulnerable-version status cannot prove compromise or non-compromise.

S24 — Detection Opportunities and Gaps

Detection Opportunities

·        Suspicious Joomla extension upload, import, profile, custom-icon, asset, media, image, library, or AJAX activity can be correlated with PHP-like file placement, HTTP access to the file, web server process execution, sensitive-file access, rare egress, and hosted-content changes.

·        JCE profile-state review may directly identify rogue editor profiles or executable upload policy changes.

·        SP Page Builder asset, custom-icon, iconfont, font, media, or component-owned path review may identify archive-extracted payloads or unexpected PHP artifacts.

·        Page Builder CK browse.ajaxAddPicture, media, image, gfonts, upload, or component-owned path review may identify unexpected executable content.

·        File telemetry can reveal PHP payload creation even when web logs are incomplete.

·        WAF, CDN, reverse-proxy, and load-balancer logs may preserve request-path evidence when local web server logs are incomplete or rotated.

·        Endpoint telemetry can reveal webshell execution through web server service-context process lineage.

·        DNS, proxy, firewall, and EDR network telemetry can reveal callbacks, tool retrieval, or abuse infrastructure after PHP execution.

·        Joomla database review can identify administrator, Super User, profile, plugin, template, content, extension, or upload-state changes.

·        FTP, file-manager, hosting-control, and backup logs may reveal attacker cleanup, persistence, restoration, lateral access, or manual remediation artifacts.

·        Backup comparison and known-good webroot baselines can identify hidden PHP files, modified templates, altered plugins, injected redirects, and content tampering.

·        Abuse reports, search-engine warnings, malware scans, spam complaints, and customer reports can provide post-exploitation impact signals where telemetry is weak.

Detection Gaps

·        Web logs may not retain query strings, request bodies, uploaded archive names, extracted file names, or multipart metadata.

·        Joomla extension state may not be auditable without direct database review.

·        File creation telemetry may not exist on shared-hosting platforms.

·        Endpoint process telemetry may not be available for commodity hosting or managed Joomla services.

·        Attackers may upload and execute PHP through one path and access or rename payloads through another path.

·        Attackers may delete uploaded archives, remove webshells, modify timestamps, or restore benign-looking content after execution.

·        File timestamps may reflect restore, migration, deployment, or backup activity rather than the original attacker action.

·        PHP execution may be blocked in some directories but allowed in others, making path-based assumptions unreliable without local validation.

·        Legitimate plugin updates, template changes, media uploads, backups, migrations, malware scans, vulnerability validation, and emergency cleanup may resemble suspicious behavior.

·        Cloud control-plane, identity, DNS, or flow telemetry cannot prove Joomla upload exploitation without application-layer, host, file, or workload correlation.

·        Vulnerability scanner findings cannot determine whether rogue files, credentials, hosted content, or CMS state were affected before patching.

Compensating Controls

·        Use WAF, CDN, reverse-proxy, load-balancer, and web server logs together to recover URI, query-string, source, virtual-host, and backend-host context.

·        Preserve logs before rotation during exposure review.

·        Inspect Joomla extension state, CMS database records, administrator accounts, Super User accounts, profile state, upload policy, page-builder asset state, templates, plugins, and content records.

·        Search writable Joomla paths for PHP-like files, mixed-case PHP, double extensions, obfuscated PHP, newly created artifacts, unexpected archives, and component-owned executable content.

·        Disable PHP execution in writable Joomla directories where operationally feasible.

·        Compare webroots against known-good backups.

·        Review FTP, file-manager, hosting-control, backup, mail, database, and abuse-desk logs.

·        Rotate Joomla administrator, database, FTP, hosting-control, SSH, mail, API, and reused credentials when compromise cannot be ruled out.

·        Review hosted content for defacement, injected redirects, phishing, malware hosting, spam scripts, SEO poisoning, and unauthorized templates or plugins.

·        Use malware scanning and YARA-style artifact triage as supporting evidence, not standalone proof of initial exploitation.

·        Maintain Joomla asset, extension, version, virtual-host, backend-host, writable-path, approved-PHP-path, approved-administrator, approved-source, approved-deployment, approved-maintenance, and approved-egress inventories.

Non-Coverage Conditions

·        Activity limited to vulnerable-version status without suspicious request, file, process, CMS state, outbound, hosting-control, or content-impact evidence.

·        Scanner traffic that does not align with PHP file placement, web access, endpoint behavior, CMS state change, or post-exploitation activity.

·        Generic PHP webshell activity with no Joomla asset, Joomla-hosted webroot, extension, path, upload, CMS state, or time-window linkage.

·        Unrelated Joomla vulnerabilities that do not involve extension upload, profile/configuration abuse, PHP placement, web-accessible execution, or webshell behavior.

·        WordPress, Drupal, Laravel, Magento, or other CMS exploitation unless the observable behavior is being used only as external comparison and not claimed as Joomla coverage.

·        Cloud-only anomalies, identity-only anomalies, database-only anomalies, mail-only anomalies, or hosting-control-only anomalies without Joomla host, source, path, file, process, identity, or time-window correlation.

·        Benign administrative maintenance, approved plugin updates, approved media uploads, approved template changes, approved backups, approved migrations, approved malware scans, approved vulnerability validation, or approved incident-response cleanup.

S25 Ultra-Tuned Detection Engineering Rules

NDR / Network Behavioral Analytics

Detection Viability Assessment

Production-deployable where the environment can join URI-preserving HTTP metadata, WAF logs, reverse-proxy logs, CDN logs, load-balancer logs, web access logs, DNS logs, proxy logs, firewall logs, NDR session telemetry, and Joomla asset inventory to the same Joomla site, virtual host, backend host, private IP, asset ID, or workload identity. Pure NetFlow is not sufficient because this detection requires Joomla extension route visibility, query-string preservation, writable-path awareness, response-pattern analysis, and outbound correlation. Use NDR as a correlation layer when it can consume or join application-layer HTTP telemetry with DNS, proxy, firewall, asset, and approved-source enrichment.

Rule

Joomla Extension Upload Abuse With Writable PHP Access or Rare Egress Correlation

Rule Format

Production-deployable NDR, WAF, reverse-proxy, CDN, load-balancer, and web-telemetry behavioral correlation pattern requiring local query-language translation.

Detection Purpose

Detect suspicious unauthenticated Joomla extension upload, profile-import, custom-icon, asset-upload, image-upload, or AJAX upload behavior that aligns with PHP-like file access in Joomla writable paths, extension-owned webroot paths, abnormal source context, suspicious response patterns, or rare outbound communication from the same Joomla host.

Detection Logic

Trigger when a Joomla asset receives POST activity against Joomla extension upload or import behavior from a source that is not an approved Joomla administrator source, approved scanner, approved hosting-provider support source, approved validation source, or approved deployment source and the activity occurs outside an approved maintenance window.

Assign medium severity when suspicious Joomla extension upload or import activity occurs against a Joomla asset without follow-on execution evidence.

Assign high severity when suspicious Joomla extension upload or import activity is followed within 60 minutes by HTTP access to a PHP-like file in Joomla writable, media, extension-owned, component-owned, iconfont, gfonts, asset, tmp, cache, template, plugin, module, upload, or image paths on the same Joomla site, virtual host, backend host, or mapped workload.

Assign high severity when suspicious Joomla extension upload or import activity includes unusual source context, suspicious user agent, archive upload behavior, repeated failure-to-success pattern, abnormal response-size pattern, or abnormal HTTP status sequence.

Promote to critical when suspicious Joomla extension upload or import activity is followed within 120 minutes by rare outbound communication from the Joomla host, endpoint-confirmed web server process execution, sensitive-file access, Joomla administrator or Super User creation, FTP activity, hosting-control activity, hosted-content modification, phishing or malware hosting, spam infrastructure, or confirmed webshell artifact discovery.

Required Telemetry

·        WAF logs.

·        Reverse-proxy logs.

·        CDN logs where applicable.

·        Load-balancer logs.

·        Web access logs.

·        URI-preserving HTTP request metadata.

·        DNS logs.

·        Proxy logs.

·        Firewall logs.

·        NDR session telemetry.

·        Joomla asset inventory.

·        Joomla extension inventory.

·        Virtual-host to backend-host mapping.

·        Joomla site to workload mapping where applicable.

·        Backend-host to private-IP mapping.

·        Backend-host to asset-ID mapping where applicable.

·        Workload identity mapping where applicable.

·        Approved Joomla administrator source lookup.

·        Approved Joomla scanner lookup.

·        Approved hosting-provider support-source lookup.

·        Approved Joomla validation-source lookup.

·        Approved deployment-source lookup.

·        Approved maintenance-window lookup.

·        Approved egress-destination lookup.

·        Approved business-domain lookup.

·        Recently seen destination-domain baseline.

·        Domain reputation enrichment where available.

·        Newly registered domain enrichment where available.

Engineering Implementation Instructions

Map HTTP method, URI path, query string, full URL, source IP, forwarded source IP, user agent, HTTP status, request size, response size, content type, virtual host, backend host, backend IP, Joomla site ID, extension family, source host, source IP, source asset ID, source workload identity, destination domain, destination IP, destination port, DNS query, proxy action, firewall action, PHP access path, first seen time, last seen time, and timestamp.

Build the Joomla asset group from CMDB records, vulnerability management inventory, web platform inventory, DNS records, reverse-proxy routing, CDN routing, load-balancer target groups, cloud tags, hosting-provider records, Joomla extension inventories, and known JCE, SP Page Builder, and Page Builder CK deployment records.

Create source exception lookups for Joomla administrators, Joomla scanners, hosting-provider support sources, validation workflows, deployment sources, and approved hosting-provider sources.

Create separate context exception lookups for approved maintenance windows, approved change-control windows, approved cleanup windows, approved emergency remediation windows, and approved vulnerability-validation windows.

Create egress exception lookups for business domains, Joomla egress destinations, expected update destinations, approved backup destinations, approved monitoring destinations, and approved hosting-provider destinations.

Validate that WAF, reverse-proxy, CDN, load-balancer, or web server logs preserve URI paths and query strings before enabling high-severity logic.

Validate that Joomla site identity can be joined to virtual host, backend host, backend IP, private IP, asset ID, workload identity, source host, and outbound telemetry before enabling critical-severity logic.

Treat TLS termination, URI visibility, backend-host joins, virtual-host mapping, source-IP preservation, source-asset mapping, workload-identity mapping, egress baselining, maintenance-window handling, approved-source tuning, and SOC routing as required local deployment work.

DRI Assessment

High resilience where URI paths, query strings, Joomla asset inventory, extension inventory, virtual-host mapping, backend-host mapping, source-asset mapping, workload-identity mapping, DNS/proxy telemetry, approved-source enrichment, maintenance-window context, and rare-destination baselining are available. Lower resilience where the platform only has flow telemetry, missing query strings, weak virtual-host mapping, incomplete extension inventory, weak maintenance context, weak source-asset joins, or no outbound enrichment.

DRI

8.7 / 10

TCR Assessment

Operational confidence is moderate for standalone suspicious Joomla extension upload or import activity and high when the activity aligns with writable-path PHP access, abnormal response behavior, rare egress, endpoint execution, CMS state change, hosting-control activity, or confirmed webshell artifacts.

Operational TCR

8.2 / 10

Full-Telemetry TCR

9.2 / 10

Limitations

Encrypted traffic without WAF, reverse-proxy, CDN, load-balancer, or server-side HTTP logging may hide Joomla extension routes and query strings. Pure NetFlow cannot detect upload route semantics, query parameters, PHP web access paths, or extension-specific behavior. NDR egress joins may fail where outbound records cannot map source host, source IP, source asset ID, or workload identity back to the affected Joomla asset. Attackers may use separate infrastructure for upload, execution, and outbound communication. Legitimate patch validation, vulnerability scanning, Joomla administration, extension updates, media uploads, emergency remediation, hosting-provider support, or malware cleanup may resemble suspicious activity. Critical promotion requires correlation beyond request telemetry, such as writable-path PHP access, endpoint execution, sensitive-file access, CMS state change, rare egress, FTP activity, hosting-control activity, content tampering, or confirmed artifact evidence.

Detection Query Pattern

Use this pattern as an implementation guide for NDR and Network Behavioral Analytics platforms that support Joomla asset mapping, extension route awareness, URI and query-string preservation, writable-path awareness, HTTP status sequencing, response-size baselining, source enrichment, destination enrichment, egress baselining, maintenance-window context, asset identity joins, workload identity joins, writable-path family matching, uploaded-path matching, and sequence logic.

LET JOOMLA_PUBLIC_ASSETS =
ENV_PUBLIC_JOOMLA_SITES
OR ENV_JOOMLA_WEB_SERVERS
OR ENV_JOOMLA_VIRTUAL_HOSTS
OR ENV_JOOMLA_BACKEND_HOSTS
OR ENV_JOOMLA_LOAD_BALANCER_TARGETS
OR ENV_JOOMLA_CDN_ORIGIN_MAPPINGS
OR ENV_JOOMLA_HOSTING_PROVIDER_ASSETS

LET JOOMLA_EXTENSION_UPLOAD_ROUTES =
ENV_JOOMLA_JCE_PROFILE_IMPORT_ROUTES
OR ENV_JOOMLA_SP_PAGE_BUILDER_UPLOAD_ROUTES
OR ENV_JOOMLA_PAGE_BUILDER_CK_UPLOAD_ROUTES
OR ENV_JOOMLA_EXTENSION_ASSET_UPLOAD_ROUTES
OR ENV_JOOMLA_MEDIA_UPLOAD_ROUTES
OR ENV_JOOMLA_AJAX_UPLOAD_ROUTES

LET APPROVED_JOOMLA_SOURCE_EXCEPTIONS =
ENV_APPROVED_JOOMLA_ADMIN_SOURCES
OR ENV_APPROVED_JOOMLA_SCANNERS
OR ENV_APPROVED_HOSTING_PROVIDER_SUPPORT_SOURCES
OR ENV_APPROVED_JOOMLA_VALIDATION_SOURCES
OR ENV_APPROVED_JOOMLA_DEPLOYMENT_SOURCES

LET APPROVED_JOOMLA_CONTEXT_EXCEPTIONS =
ENV_APPROVED_JOOMLA_MAINTENANCE_WINDOWS
OR ENV_APPROVED_JOOMLA_CHANGE_WINDOWS
OR ENV_APPROVED_JOOMLA_CLEANUP_WINDOWS
OR ENV_APPROVED_JOOMLA_REMEDIATION_WINDOWS
OR ENV_APPROVED_JOOMLA_VALIDATION_WINDOWS

LET JOOMLA_WRITABLE_OR_EXTENSION_PATH_PREFIXES =
ENV_JOOMLA_MEDIA_PATH_PREFIXES
OR ENV_JOOMLA_IMAGE_PATH_PREFIXES
OR ENV_JOOMLA_TMP_PATH_PREFIXES
OR ENV_JOOMLA_CACHE_PATH_PREFIXES
OR ENV_JOOMLA_UPLOAD_PATH_PREFIXES
OR ENV_JOOMLA_ASSET_PATH_PREFIXES
OR ENV_JOOMLA_ICONFONT_PATH_PREFIXES
OR ENV_JOOMLA_GFONTS_PATH_PREFIXES
OR ENV_JOOMLA_TEMPLATE_PATH_PREFIXES
OR ENV_JOOMLA_PLUGIN_PATH_PREFIXES
OR ENV_JOOMLA_COMPONENT_PATH_PREFIXES
OR ENV_JOOMLA_MODULE_PATH_PREFIXES
OR ENV_JOOMLA_EXTENSION_OWNED_WEBROOT_PATH_PREFIXES

LET PHP_LIKE_WEB_ARTIFACT_PATTERNS =
ENV_PHP_EXTENSION_PATTERNS
OR ENV_PHTML_EXTENSION_PATTERNS
OR ENV_PHAR_EXTENSION_PATTERNS
OR ENV_MIXED_CASE_PHP_EXTENSION_PATTERNS
OR ENV_DOUBLE_EXTENSION_PHP_PATTERNS
OR ENV_ARCHIVE_EXTRACTED_PHP_PATTERNS
OR ENV_OBFUSCATED_PHP_FILENAME_PATTERNS

LET APPROVED_JOOMLA_EGRESS =
ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS
OR ENV_APPROVED_BUSINESS_DOMAINS
OR ENV_APPROVED_HOSTING_PROVIDER_DESTINATIONS
OR ENV_APPROVED_JOOMLA_UPDATE_DESTINATIONS
OR ENV_APPROVED_BACKUP_DESTINATIONS
OR ENV_APPROVED_MONITORING_DESTINATIONS

LET suspicious_joomla_extension_upload_request =
network_or_gateway_events
WHERE destination_host IN JOOMLA_PUBLIC_ASSETS
AND request_method = "POST"
AND source_ip NOT IN APPROVED_JOOMLA_SOURCE_EXCEPTIONS
AND event_time NOT IN APPROVED_JOOMLA_CONTEXT_EXCEPTIONS
AND (
request_path MATCHES_ANY JOOMLA_EXTENSION_UPLOAD_ROUTES
OR (
request_query CONTAINS "option=com_jce"
AND request_query CONTAINS "task=profiles.import"
)
OR (
(
request_query CONTAINS "option=com_sppagebuilder"
OR request_path CONTAINS "/com_sppagebuilder/"
OR request_path CONTAINS "/sppagebuilder/"
)
AND (
request_query CONTAINS "task=asset.uploadCustomIcon"
OR request_path CONTAINS "asset.uploadCustomIcon"
OR request_path CONTAINS "uploadCustomIcon"
)
)
OR (
(
request_query CONTAINS "option=com_pagebuilderck"
OR request_path CONTAINS "/com_pagebuilderck/"
OR request_path CONTAINS "/pagebuilderck/"
)
AND (
request_query CONTAINS "browse.ajaxAddPicture"
OR request_path CONTAINS "browse.ajaxAddPicture"
OR request_path CONTAINS "ajaxAddPicture"
)
)
)
AND (
source_first_seen_status IN ("new", "rare")
OR source_asn IN ENV_SUSPICIOUS_ASNS
OR source_network_type IN ("cloud_hosted", "residential_proxy", "vpn_provider", "scanner_infrastructure", "unknown_hosting")
OR source_geo NOT IN ENV_JOOMLA_EXPECTED_SOURCE_GEOS
OR user_agent IN ENV_RARE_OR_AUTOMATED_USER_AGENTS
OR content_type IN ("multipart/form-data", "application/zip", "application/octet-stream")
OR request_size > ENV_JOOMLA_EXTENSION_UPLOAD_REQUEST_SIZE_BASELINE
OR response_size > ENV_JOOMLA_EXTENSION_UPLOAD_RESPONSE_SIZE_UPPER_BASELINE
OR response_size < ENV_JOOMLA_EXTENSION_UPLOAD_RESPONSE_SIZE_LOWER_BASELINE
OR request_timing_pattern IN ("rapid_retry", "automation_like", "low_and_slow_probe", "failed_then_successful_upload")
OR http_status_sequence IN ("repeated_errors", "errors_then_success", "upload_success_after_errors", "abnormal_redirect_sequence")
)

LET writable_path_php_access =
network_or_gateway_events
WHERE destination_host IN JOOMLA_PUBLIC_ASSETS
AND request_method IN ("GET", "POST")
AND request_path STARTS_WITH_ANY JOOMLA_WRITABLE_OR_EXTENSION_PATH_PREFIXES
AND request_path MATCHES_ANY PHP_LIKE_WEB_ARTIFACT_PATTERNS
AND event_time NOT IN APPROVED_JOOMLA_CONTEXT_EXCEPTIONS
AND (
http_status IN (200, 206, 302, 403, 404, 500)
OR response_size_delta > ENV_JOOMLA_PHP_ACCESS_RESPONSE_SIZE_DELTA_BASELINE
OR request_timing_pattern IN ("single_probe_then_repeat", "interactive_webshell_like", "low_volume_callback_test")
OR user_agent IN ENV_RARE_OR_AUTOMATED_USER_AGENTS
)

LET rare_joomla_host_egress =
dns_proxy_firewall_or_ndr_events
WHERE (
source_host IN JOOMLA_PUBLIC_ASSETS
OR source_ip IN JOOMLA_PUBLIC_ASSETS
OR source_asset_id IN JOOMLA_PUBLIC_ASSETS
OR source_workload_identity IN JOOMLA_PUBLIC_ASSETS
)
AND (
destination_domain IS NOT NULL
OR destination_ip IS NOT NULL
)
AND (
destination_domain IS NULL
OR destination_domain NOT IN APPROVED_JOOMLA_EGRESS
)
AND (
destination_ip IS NULL
OR destination_ip NOT IN APPROVED_JOOMLA_EGRESS
)
AND event_time NOT IN APPROVED_JOOMLA_CONTEXT_EXCEPTIONS
AND (
destination_first_seen_status IN ("new", "rare")
OR destination_domain_age_days < ENV_NEW_DOMAIN_AGE_DAYS
OR destination_reputation IN ("unknown", "suspicious", "malicious")
OR destination_asn IN ENV_SUSPICIOUS_ASNS
OR destination_geo NOT IN ENV_JOOMLA_EXPECTED_EGRESS_GEOS
OR destination_port IN ENV_UNUSUAL_JOOMLA_EGRESS_PORTS
OR proxy_action IN ("allowed", "proxied", "connected")
OR firewall_action IN ("allowed", "connected")
)

SEQUENCE suspicious_joomla_extension_upload_request THEN writable_path_php_access
WHERE (
same_destination_host = true
OR same_virtual_host = true
OR same_backend_host = true
OR same_joomla_site_id = true
)
AND (
same_source_ip = true
OR same_source_network = true
OR same_extension_family = true
OR same_writable_path_family = true
OR same_uploaded_path = true
)
WITHIN ENV_JOOMLA_UPLOAD_TO_PHP_ACCESS_WINDOW

OR

SEQUENCE suspicious_joomla_extension_upload_request THEN rare_joomla_host_egress
WHERE (
same_destination_host = true
OR same_backend_host = true
OR same_joomla_site_id = true
OR same_workload_identity = true
)
WITHIN ENV_JOOMLA_UPLOAD_TO_EGRESS_WINDOW

OUTPUT
joomla_site_id,
destination_host,
destination_ip,
virtual_host,
backend_host,
extension_family,
request_path,
request_query,
request_method,
source_ip,
forwarded_source_ip,
source_asn,
source_geo,
source_network_type,
user_agent,
content_type,
request_size,
response_size,
response_size_delta,
http_status,
http_status_sequence,
request_timing_pattern,
php_or_webshell_access_path,
egress_destination_domain,
egress_destination_ip,
egress_destination_port,
egress_destination_reputation,
egress_destination_domain_age_days,
proxy_action,
firewall_action,
first_seen,
last_seen,
time_delta

SentinelOne

Detection Viability Assessment

Production-deployable where SentinelOne covers Joomla web servers and collects process creation, parent process, command line, process user, file activity, network activity, endpoint tags, and endpoint identity. This rule is strongest on self-managed Joomla servers, dedicated web servers, cloud-hosted Joomla workloads, and container hosts where web server processes can be separated from approved deployment, backup, plugin update, migration, malware scanning, hosting-provider maintenance, vulnerability validation, and emergency cleanup activity. It is limited or unavailable in shared-hosting environments where endpoint telemetry is not exposed.

Rule

Joomla Web Server Service Context Execution With Writable PHP Artifact or Rare Egress

Rule Format

SentinelOne Deep Visibility or STAR logic pattern requiring local field validation, endpoint tagging, path mapping, approved workflow exceptions, and downstream SIEM or XDR enrichment.

Detection Purpose

Detect suspicious Joomla host behavior consistent with PHP webshell execution after extension upload abuse, including PHP-like file creation in writable Joomla paths, web server service-context execution, sensitive Joomla file access, command execution, transfer-tool use, archive activity, encoding behavior, database access, or rare outbound communication.

Detection Logic

Trigger when a Joomla web server records PHP-like file creation, modification, rename, or write activity in writable Joomla or extension-owned webroot paths outside approved deployment, maintenance, update, backup, migration, validation, cleanup, hosting-provider, or security-tool workflows.

Assign medium severity when unexpected PHP-like file activity occurs in Joomla writable, media, image, upload, tmp, cache, asset, iconfont, gfonts, template, plugin, component, module, or extension-owned paths.

Assign high severity when PHP-like file activity aligns with web server service-context execution, shell invocation, scripting interpreter use, transfer-tool activity, archive-tool activity, encoded command behavior, sensitive Joomla file access, database dump activity, or rare outbound communication.

Promote to critical when endpoint behavior is correlated with suspicious Joomla extension upload or import activity, HTTP access to the planted PHP-like file, confirmed webshell artifact discovery, Joomla administrator or Super User creation, credential-file access, database access, FTP or hosting-control abuse, hosted-content tampering, phishing or malware hosting, spam infrastructure, or multi-site compromise.

Required Telemetry

·        SentinelOne process telemetry.

·        SentinelOne parent process telemetry.

·        SentinelOne command-line telemetry.

·        SentinelOne file telemetry.

·        SentinelOne network telemetry.

·        Endpoint tags or endpoint groups for Joomla web servers.

·        Joomla webroot path mapping.

·        Joomla writable-path mapping.

·        Joomla extension-owned path mapping.

·        Web server service-user mapping.

·        Web server process-name mapping.

·        Approved deployment-user lookup.

·        Approved deployment-command lookup.

·        Approved backup and restore workflow lookup.

·        Approved plugin update workflow lookup.

·        Approved migration workflow lookup.

·        Approved vulnerability-validation workflow lookup.

·        Approved emergency cleanup workflow lookup.

·        Approved hosting-provider user lookup.

·        Approved maintenance-window lookup.

·        Approved egress-destination lookup.

·        Recently seen destination-domain baseline where available.

·        Destination reputation enrichment where available.

Engineering Implementation Instructions

Map EndpointName, EndpointId, AgentUuid, EndpointTags, UserName, ProcessUser, ProcessName, ParentProcessName, CommandLine, FilePath, FileName, FileExtension, EventType, EventTime, DestinationHost, DestinationIp, DestinationPort, DestinationDomain, DestinationFirstSeenStatus, DestinationReputation, DestinationDomainAgeDays, DestinationAsn, DestinationGeo, NetworkAction, and timestamp.

Create endpoint tags or endpoint groups for Joomla web servers, public Joomla sites, Joomla backend hosts, shared-hosting endpoints where telemetry is available, containerized Joomla workloads, cloud-hosted Joomla workloads, and dedicated Joomla web servers.

Create path lists for Joomla webroots, media directories, images directories, tmp directories, cache directories, upload directories, asset directories, iconfont directories, gfonts directories, template directories, plugin directories, component directories, module directories, backup directories, and extension-owned writable paths.

Validate local web server process and service-user names, including apache2, httpd, nginx, php-fpm, lsphp, php-cgi, cgi-fcgi, litespeed, openlitespeed, www-data, apache, nginx, nobody, litespeed, container runtimes, and hosting-provider service wrappers.

Create exceptions for approved Joomla deployments, plugin updates, template changes, media operations, backup jobs, restore jobs, migrations, vulnerability validation, malware scanning, emergency cleanup, hosting-provider support, and approved maintenance windows.

Run in hunt mode before alert mode to baseline normal Joomla administration, CMS update behavior, extension update behavior, image processing, cache generation, deployment activity, backup operations, restore activity, hosting-provider maintenance, and incident-response cleanup.

Treat endpoint grouping, path mapping, service-account mapping, approved workflow exceptions, maintenance-window suppression, rare-egress baselining, and SOC routing as required local deployment work.

DRI Assessment

High resilience where SentinelOne captures process lineage, command line, file activity, network activity, endpoint tags, and Joomla path mapping. Lower resilience where Joomla hosts lack endpoint coverage, file telemetry is incomplete, command-line telemetry is unavailable, or approved deployment, hosting-provider, and maintenance workflows are not baselined.

DRI

8.8 / 10

TCR Assessment

Operational confidence is strong when suspicious web server service-context execution aligns with writable-path PHP artifacts, sensitive-file access, rare egress, or suspicious tooling. Confidence is highest when downstream SIEM, XDR, WAF, reverse-proxy, CDN, or web access telemetry correlates endpoint behavior to Joomla extension upload or PHP web access activity.

Operational TCR

8.4 / 10

Full-Telemetry TCR

9.3 / 10

Limitations

SentinelOne may not observe the initial Joomla extension request unless HTTP telemetry is ingested elsewhere or correlated downstream. Shared-hosting and managed-hosting environments may not provide endpoint telemetry. Legitimate Joomla deployments, plugin updates, template changes, backup jobs, restore jobs, migrations, vulnerability validation, malware scans, hosting-provider maintenance, and emergency cleanup may create or modify PHP files or execute scripts. This rule must be scoped to Joomla hosts and tuned against approved workflows before alert-mode deployment. Critical promotion requires correlation beyond endpoint activity alone, such as suspicious Joomla extension request telemetry, HTTP access to the PHP-like file, CMS state change, confirmed artifact evidence, credential access, rare egress, hosting-control activity, or hosted-content impact.

Detection Query Pattern

Use this pattern as an implementation guide for SentinelOne Deep Visibility or STAR logic that supports endpoint tags, process telemetry, parent-process telemetry, command-line telemetry, file telemetry, network telemetry, user context, path mapping, approved workflow exceptions, and downstream SIEM or XDR enrichment. Joomla extension request, WAF, reverse-proxy, CDN, web access, CMS state, FTP, and hosting-control correlation should occur in the SIEM, XDR, or downstream investigation workflow.

LET JOOMLA_WEB_ENDPOINTS =
EndpointTags CONTAINS ANY (
"ENV_JOOMLA_WEB_SERVERS",
"ENV_PUBLIC_JOOMLA_SITES",
"ENV_JOOMLA_BACKEND_HOSTS",
"ENV_JOOMLA_SHARED_HOSTING_ENDPOINTS",
"ENV_JOOMLA_CONTAINER_HOSTS",
"ENV_JOOMLA_CLOUD_WORKLOADS",
"ENV_JOOMLA_DEDICATED_WEB_SERVERS"
)

LET JOOMLA_WEB_SERVER_CONTEXT =
ProcessUser IN ENV_JOOMLA_WEB_SERVER_SERVICE_USERS
OR UserName IN ENV_JOOMLA_WEB_SERVER_SERVICE_USERS
OR ParentProcessName IN ENV_JOOMLA_WEB_SERVER_PROCESSES
OR ProcessName IN ENV_JOOMLA_PHP_RUNTIME_PROCESSES
OR CommandLine MATCHES ENV_JOOMLA_WEB_SERVER_RUNTIME_PATTERNS

LET JOOMLA_WRITABLE_OR_EXTENSION_PATHS =
FilePath STARTS_WITH ANY (
ENV_JOOMLA_MEDIA_PATH_PREFIXES,
ENV_JOOMLA_IMAGE_PATH_PREFIXES,
ENV_JOOMLA_TMP_PATH_PREFIXES,
ENV_JOOMLA_CACHE_PATH_PREFIXES,
ENV_JOOMLA_UPLOAD_PATH_PREFIXES,
ENV_JOOMLA_ASSET_PATH_PREFIXES,
ENV_JOOMLA_ICONFONT_PATH_PREFIXES,
ENV_JOOMLA_GFONTS_PATH_PREFIXES,
ENV_JOOMLA_TEMPLATE_PATH_PREFIXES,
ENV_JOOMLA_PLUGIN_PATH_PREFIXES,
ENV_JOOMLA_COMPONENT_PATH_PREFIXES,
ENV_JOOMLA_MODULE_PATH_PREFIXES,
ENV_JOOMLA_EXTENSION_OWNED_WEBROOT_PATH_PREFIXES
)

LET PHP_LIKE_FILE_ACTIVITY =
FileName MATCHES ANY (
ENV_PHP_EXTENSION_PATTERNS,
ENV_PHTML_EXTENSION_PATTERNS,
ENV_PHAR_EXTENSION_PATTERNS,
ENV_MIXED_CASE_PHP_EXTENSION_PATTERNS,
ENV_DOUBLE_EXTENSION_PHP_PATTERNS,
ENV_ARCHIVE_EXTRACTED_PHP_PATTERNS,
ENV_OBFUSCATED_PHP_FILENAME_PATTERNS
)
AND EventType IN (
"file_created",
"file_modified",
"file_renamed",
"file_written"
)

LET SUSPICIOUS_WEB_SERVER_CHILD_PROCESS =
JOOMLA_WEB_SERVER_CONTEXT = true
AND (
ProcessName IN ENV_SHELL_INTERPRETERS
OR ProcessName IN ENV_SCRIPTING_INTERPRETERS
OR ProcessName IN ENV_TRANSFER_TOOLS
OR ProcessName IN ENV_ARCHIVE_TOOLS
OR ProcessName IN ENV_NETWORK_TOOLS
OR ProcessName IN ENV_DATABASE_TOOLS
OR ProcessName IN ENV_ENCODING_OR_OBFUSCATION_TOOLS
OR CommandLine MATCHES ENV_WEB_SERVER_SUSPICIOUS_COMMAND_PATTERNS
OR CommandLine MATCHES ENV_JOOMLA_CREDENTIAL_ACCESS_COMMAND_PATTERNS
OR CommandLine MATCHES ENV_JOOMLA_DISCOVERY_COMMAND_PATTERNS
)

LET SENSITIVE_JOOMLA_FILE_ACCESS =
FilePath MATCHES ANY (
ENV_JOOMLA_CONFIGURATION_FILE_PATTERNS,
ENV_JOOMLA_DATABASE_DUMP_PATTERNS,
ENV_JOOMLA_BACKUP_FILE_PATTERNS,
ENV_JOOMLA_ENVIRONMENT_FILE_PATTERNS,
ENV_JOOMLA_CREDENTIAL_FILE_PATTERNS,
ENV_JOOMLA_MAIL_CONFIGURATION_PATTERNS,
ENV_JOOMLA_API_KEY_FILE_PATTERNS
)
AND EventType IN (
"file_opened",
"file_read",
"file_modified",
"file_copied",
"file_archived"
)

LET RARE_JOOMLA_ENDPOINT_EGRESS =
(
DestinationHost IS NOT NULL
OR DestinationIp IS NOT NULL
)
AND (
DestinationHost IS NULL
OR DestinationHost NOT IN ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS
)
AND (
DestinationIp IS NULL
OR DestinationIp NOT IN ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS
)
AND (
DestinationFirstSeenStatus IN ("new", "rare")
OR DestinationDomainAgeDays < ENV_NEW_DOMAIN_AGE_DAYS
OR DestinationReputation IN ("unknown", "suspicious", "malicious")
OR DestinationAsn IN ENV_SUSPICIOUS_ASNS
OR DestinationGeo NOT IN ENV_JOOMLA_EXPECTED_EGRESS_GEOS
OR DestinationPort IN ENV_UNUSUAL_JOOMLA_EGRESS_PORTS
)

LET APPROVED_JOOMLA_ENDPOINT_ACTIVITY =
UserName IN ENV_APPROVED_JOOMLA_DEPLOYMENT_USERS
OR UserName IN ENV_APPROVED_JOOMLA_BACKUP_USERS
OR UserName IN ENV_APPROVED_JOOMLA_MIGRATION_USERS
OR UserName IN ENV_APPROVED_HOSTING_PROVIDER_USERS
OR ProcessName IN ENV_APPROVED_JOOMLA_DEPLOYMENT_TOOLS
OR ProcessName IN ENV_APPROVED_JOOMLA_BACKUP_TOOLS
OR ProcessName IN ENV_APPROVED_JOOMLA_SECURITY_TOOLS
OR CommandLine MATCHES ENV_APPROVED_JOOMLA_COMMAND_PATTERNS
OR EventTime IN ENV_APPROVED_JOOMLA_MAINTENANCE_WINDOWS
OR EventTime IN ENV_APPROVED_JOOMLA_VALIDATION_WINDOWS
OR EventTime IN ENV_APPROVED_JOOMLA_CLEANUP_WINDOWS

FROM ProcessEvents OR FileEvents OR NetworkEvents
WHERE JOOMLA_WEB_ENDPOINTS = true
AND APPROVED_JOOMLA_ENDPOINT_ACTIVITY != true
AND (
(
JOOMLA_WRITABLE_OR_EXTENSION_PATHS = true
AND PHP_LIKE_FILE_ACTIVITY = true
)
OR SUSPICIOUS_WEB_SERVER_CHILD_PROCESS = true
OR SENSITIVE_JOOMLA_FILE_ACCESS = true
OR RARE_JOOMLA_ENDPOINT_EGRESS = true
)
AND (
JOOMLA_WEB_SERVER_CONTEXT = true
OR (
FilePath IS NOT NULL
AND FilePath STARTS_WITH ANY ENV_JOOMLA_WEBROOT_PATH_PREFIXES
)
OR (
CommandLine IS NOT NULL
AND CommandLine MATCHES ENV_JOOMLA_WEBROOT_COMMAND_PATTERNS
)
OR (
DestinationHost IS NOT NULL
AND DestinationHost NOT IN ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS
)
OR (
DestinationIp IS NOT NULL
AND DestinationIp NOT IN ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS
)
)
AND (
(
FilePath IS NOT NULL
AND FilePath NOT IN ENV_APPROVED_JOOMLA_FILE_PATHS
)
OR (
CommandLine IS NOT NULL
AND CommandLine NOT IN ENV_APPROVED_JOOMLA_COMMAND_PATTERNS
)
OR (
DestinationHost IS NOT NULL
AND DestinationHost NOT IN ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS
)
OR (
DestinationIp IS NOT NULL
AND DestinationIp NOT IN ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS
)
OR (
ProcessName IS NOT NULL
AND ProcessName NOT IN ENV_APPROVED_JOOMLA_PROCESS_BASELINE
)
)
OUTPUT
EndpointName,
EndpointTags,
UserName,
ProcessUser,
ProcessName,
ParentProcessName,
CommandLine,
FilePath,
FileName,
FileExtension,
EventType,
EventTime,
DestinationHost,
DestinationIp,
DestinationPort,
DestinationDomain,
DestinationFirstSeenStatus,
DestinationReputation,
DestinationDomainAgeDays,
DestinationAsn,
DestinationGeo,
NetworkAction

Splunk

Detection Viability Assessment

Production-deployable where Splunk receives WAF, reverse-proxy, CDN, load-balancer, web access, DNS, proxy, firewall, endpoint, EDR, Linux audit, web server, Joomla asset inventory, Joomla extension inventory, and approved-source enrichment. Splunk is the best platform in this rule set for correlating suspicious Joomla extension upload behavior with PHP-like file access, endpoint execution, rare egress, sensitive-file access, CMS state changes, FTP activity, hosting-control activity, and hosted-content impact. Customer-specific indexes, sourcetypes, CIM mappings, summary indexes, accelerated data sources, field names, macros, and lookups must be abstracted locally.

Rule

Joomla Extension Upload Abuse Correlated With PHP Web Access or Rare Egress

Rule Format

Splunk SPL correlation pattern requiring local macro abstraction, normalized field mapping, Joomla asset enrichment, extension-route enrichment, approved-source lookups, writable-path lookups, egress baselining, and downstream SOC triage.

Detection Purpose

Detect suspicious Joomla extension upload, profile-import, custom-icon upload, asset upload, image upload, media upload, or AJAX upload activity that correlates with PHP-like file access in writable Joomla paths or rare outbound communication from the same Joomla site, backend host, asset, or workload.

Detection Logic

Trigger when a Joomla asset receives suspicious POST activity against Joomla extension upload or import behavior from a source that is not an approved Joomla administrator, scanner, hosting-provider support source, validation source, deployment source, or maintenance workflow.

Assign medium severity when suspicious Joomla extension upload or import activity occurs without follow-on execution or egress evidence.

Assign high severity when suspicious Joomla extension upload or import activity is followed by HTTP access to a PHP-like file in Joomla writable, media, image, upload, tmp, cache, asset, iconfont, gfonts, template, plugin, component, module, or extension-owned webroot paths.

Assign high severity when suspicious Joomla extension upload or import activity aligns with unusual source context, suspicious user agent, abnormal response-size behavior, repeated failure-to-success behavior, or abnormal HTTP status sequencing.

Promote to critical when suspicious Joomla extension upload or import activity is followed by rare egress from the Joomla host, endpoint-confirmed web server process execution, credential-file access, database access, Joomla administrator or Super User creation, FTP activity, hosting-control activity, hosted-content tampering, phishing or malware hosting, spam infrastructure, or confirmed webshell artifact discovery.

Required Telemetry

·        Splunk WAF logs.

·        Splunk reverse-proxy logs.

·        Splunk CDN logs where applicable.

·        Splunk load-balancer logs.

·        Splunk web access logs.

·        Splunk DNS logs.

·        Splunk proxy logs.

·        Splunk firewall logs.

·        Splunk endpoint telemetry.

·        Splunk EDR telemetry where available.

·        Linux audit or file-integrity telemetry where available.

·        Joomla asset inventory lookup.

·        Joomla extension inventory lookup.

·        Joomla virtual-host to backend-host mapping.

·        Joomla site to workload mapping where applicable.

·        Backend-host to private-IP mapping.

·        Approved Joomla administrator source lookup.

·        Approved Joomla scanner lookup.

·        Approved hosting-provider support-source lookup.

·        Approved Joomla validation-source lookup.

·        Approved deployment-source lookup.

·        Approved maintenance-window lookup.

·        Approved egress-destination lookup.

·        Recently seen destination-domain baseline.

·        Destination reputation enrichment where available.

Engineering Implementation Instructions

Normalize HTTP method, URI path, query string, full URL, source IP, forwarded source IP, user agent, HTTP status, request size, response size, virtual host, destination host, backend host, private IP, Joomla site ID, extension family, destination domain, destination IP, destination port, DNS query, proxy action, firewall action, first seen time, last seen time, and event timestamp.

Create macros for Joomla web telemetry, Joomla asset identity, suspicious Joomla extension upload routes, writable Joomla path prefixes, PHP-like web artifact patterns, approved Joomla source exceptions, approved maintenance windows, and approved Joomla egress destinations.

Create lookups for JCE profile-import routes, SP Page Builder upload routes, Page Builder CK upload routes, generic Joomla media upload routes, AJAX upload routes, Joomla writable paths, Joomla extension-owned paths, approved Joomla administrator sources, approved scanner sources, approved hosting-provider support sources, approved validation sources, approved deployment sources, approved maintenance windows, approved egress destinations, and Joomla asset mappings.

Use accelerated data models, summary indexes, or scheduled correlation searches where raw web telemetry volume is high.

Validate that query strings are preserved before enabling extension-route logic.

Validate that virtual-host, backend-host, private-IP, asset-ID, and workload mappings can correlate inbound web activity to outbound DNS, proxy, firewall, or endpoint telemetry before enabling critical-severity promotion.

Treat macro abstraction, lookup ownership, URI preservation, source-IP preservation, asset identity joins, maintenance-window suppression, egress baselining, and SOC routing as required local deployment work.

DRI Assessment

High resilience where Splunk has normalized web telemetry, query strings, Joomla asset mapping, extension-route lookup coverage, writable-path lookup coverage, approved-source enrichment, and outbound telemetry joins. Lower resilience where logs lack query strings, virtual-host mapping is weak, source-IP preservation is inconsistent, writable-path lookup coverage is incomplete, or egress telemetry cannot be joined back to the affected Joomla asset.

DRI

8.9 / 10

TCR Assessment

Operational confidence is strong when suspicious Joomla extension upload behavior correlates with PHP-like web access or rare egress. Confidence is highest when Splunk also receives endpoint execution, sensitive-file access, CMS state, FTP, hosting-control, or artifact-confirmation telemetry.

Operational TCR

8.5 / 10

Full-Telemetry TCR

9.4 / 10

Limitations

Splunk cannot reliably detect Joomla extension upload abuse from pure flow data or web telemetry that omits URI paths and query strings. High-volume web environments may require summary indexing, accelerated data models, tuned macros, or scheduled searches. Legitimate Joomla administration, plugin updates, media uploads, deployment workflows, vulnerability validation, hosting-provider support, malware cleanup, and emergency remediation may resemble suspicious activity. Critical promotion depends on reliable correlation between web request telemetry and endpoint, DNS, proxy, firewall, CMS, FTP, hosting-control, or artifact evidence.

Detection Query Pattern

Use this pattern as an implementation guide for Splunk environments that support WAF, reverse-proxy, CDN, load-balancer, web access, DNS, proxy, firewall, endpoint, Joomla asset, Joomla extension, source-enrichment, destination-enrichment, and maintenance-window correlation. Customer-specific indexes, sourcetypes, field names, CIM mappings, summary indexes, accelerated data sources, macros, and local enrichment should be abstracted behind macros and lookups.

`joomla_web_http_events`

| eval normalized_dest=coalesce(dest, dest_host, host, http_host, site_host, vhost, virtual_host)

| eval normalized_backend=coalesce(backend_host, origin_host, server_name, target_host, host)

| eval normalized_src_ip=coalesce(src_ip, client_ip, source_ip, c_ip, forwarded_for, x_forwarded_for)

| eval normalized_user_agent=coalesce(user_agent, http_user_agent, cs_user_agent)

| eval normalized_method=coalesce(method, http_method, request_method, cs_method)

| eval normalized_path=coalesce(uri_path, url_path, request_path, cs_uri_stem)

| eval normalized_query=coalesce(uri_query, query, request_query, cs_uri_query)

| eval normalized_status=coalesce(status, http_status, sc_status)

| eval normalized_request_size=coalesce(bytes_in, request_size, cs_bytes)

| eval normalized_response_size=coalesce(bytes_out, response_size, sc_bytes, bytes)

| eval normalized_time=_time

| lookup ENV_JOOMLA_PUBLIC_ASSETS normalized_dest OUTPUT joomla_asset_match joomla_site_id asset_role

| lookup ENV_JOOMLA_VIRTUAL_HOST_BACKEND_MAP normalized_dest OUTPUT backend_host private_ip workload_identity

| lookup ENV_JOOMLA_EXTENSION_UPLOAD_ROUTES normalized_path normalized_query OUTPUT extension_route_match extension_family route_role

| lookup ENV_APPROVED_JOOMLA_SOURCE_EXCEPTIONS normalized_src_ip OUTPUT approved_source source_role

| lookup ENV_APPROVED_JOOMLA_CONTEXT_WINDOWS normalized_time OUTPUT approved_context_window

| where joomla_asset_match="true"

| where normalized_method="POST"

| where approved_source!="true"

| where approved_context_window!="true"

| where extension_route_match="true"

OR (

normalized_query LIKE "%option=com_jce%"

AND normalized_query LIKE "%task=profiles.import%"

)

OR (

(

normalized_query LIKE "%option=com_sppagebuilder%"

OR normalized_path LIKE "%/com_sppagebuilder/%"

OR normalized_path LIKE "%/sppagebuilder/%"

)

AND (

normalized_query LIKE "%task=asset.uploadCustomIcon%"

OR normalized_path LIKE "%asset.uploadCustomIcon%"

OR normalized_path LIKE "%uploadCustomIcon%"

)

)

OR (

(

normalized_query LIKE "%option=com_pagebuilderck%"

OR normalized_path LIKE "%/com_pagebuilderck/%"

OR normalized_path LIKE "%/pagebuilderck/%"

)

AND (

normalized_query LIKE "%browse.ajaxAddPicture%"

OR normalized_path LIKE "%browse.ajaxAddPicture%"

OR normalized_path LIKE "%ajaxAddPicture%"

)

)

| where source_first_seen_status IN ("new", "rare")

OR source_network_type IN ("cloud_hosted", "residential_proxy", "vpn_provider", "scanner_infrastructure", "unknown_hosting")

OR source_geo NOT IN ENV_JOOMLA_EXPECTED_SOURCE_GEOS

OR normalized_user_agent IN ENV_RARE_OR_AUTOMATED_USER_AGENTS

OR content_type IN ("multipart/form-data", "application/zip", "application/octet-stream")

OR normalized_request_size > ENV_JOOMLA_EXTENSION_UPLOAD_REQUEST_SIZE_BASELINE

OR normalized_response_size > ENV_JOOMLA_EXTENSION_UPLOAD_RESPONSE_SIZE_UPPER_BASELINE

OR normalized_response_size < ENV_JOOMLA_EXTENSION_UPLOAD_RESPONSE_SIZE_LOWER_BASELINE

OR request_timing_pattern IN ("rapid_retry", "automation_like", "low_and_slow_probe", "failed_then_successful_upload")

OR http_status_sequence IN ("repeated_errors", "errors_then_success", "upload_success_after_errors", "abnormal_redirect_sequence")

| eval event_kind="suspicious_joomla_extension_upload"

| eval candidate_time=normalized_time

| eval correlation_site=coalesce(joomla_site_id, normalized_dest)

| eval correlation_dest=normalized_dest

| eval correlation_backend=coalesce(backend_host, normalized_backend)

| eval correlation_workload=workload_identity

| eval carry_src_ip=normalized_src_ip

| eval carry_extension_family=extension_family

| fields event_kind candidate_time correlation_site correlation_dest correlation_backend correlation_workload carry_src_ip carry_extension_family normalized_path normalized_query normalized_status normalized_request_size normalized_response_size normalized_user_agent source_first_seen_status source_network_type source_geo

| append [

`joomla_web_http_events`

| eval normalized_dest=coalesce(dest, dest_host, host, http_host, site_host, vhost, virtual_host)

| eval normalized_backend=coalesce(backend_host, origin_host, server_name, target_host, host)

| eval normalized_src_ip=coalesce(src_ip, client_ip, source_ip, c_ip, forwarded_for, x_forwarded_for)

| eval normalized_user_agent=coalesce(user_agent, http_user_agent, cs_user_agent)

| eval normalized_method=coalesce(method, http_method, request_method, cs_method)

| eval normalized_path=coalesce(uri_path, url_path, request_path, cs_uri_stem)

| eval normalized_status=coalesce(status, http_status, sc_status)

| eval normalized_response_size=coalesce(bytes_out, response_size, sc_bytes, bytes)

| eval normalized_time=_time

| lookup ENV_JOOMLA_PUBLIC_ASSETS normalized_dest OUTPUT joomla_asset_match joomla_site_id asset_role

| lookup ENV_JOOMLA_VIRTUAL_HOST_BACKEND_MAP normalized_dest OUTPUT backend_host private_ip workload_identity

| lookup ENV_JOOMLA_WRITABLE_OR_EXTENSION_PATHS normalized_path OUTPUT writable_path_match writable_path_family

| lookup ENV_PHP_LIKE_WEB_ARTIFACT_PATTERNS normalized_path OUTPUT php_artifact_match php_artifact_family

| lookup ENV_APPROVED_JOOMLA_CONTEXT_WINDOWS normalized_time OUTPUT approved_context_window

| where joomla_asset_match="true"

| where approved_context_window!="true"

| where normalized_method IN ("GET", "POST")

| where writable_path_match="true"

| where php_artifact_match="true"

| where normalized_status IN (200, 206, 302, 403, 404, 500)

OR response_size_delta > ENV_JOOMLA_PHP_ACCESS_RESPONSE_SIZE_DELTA_BASELINE

OR request_timing_pattern IN ("single_probe_then_repeat", "interactive_webshell_like", "low_volume_callback_test")

OR normalized_user_agent IN ENV_RARE_OR_AUTOMATED_USER_AGENTS

| eval event_kind="joomla_writable_php_access"

| eval candidate_time=normalized_time

| eval correlation_site=coalesce(joomla_site_id, normalized_dest)

| eval correlation_dest=normalized_dest

| eval correlation_backend=coalesce(backend_host, normalized_backend)

| eval correlation_workload=workload_identity

| eval carry_php_path=normalized_path

| eval carry_writable_path_family=writable_path_family

| fields event_kind candidate_time correlation_site correlation_dest correlation_backend correlation_workload normalized_src_ip carry_php_path carry_writable_path_family normalized_status normalized_response_size request_timing_pattern

]

| append [

`joomla_dns_proxy_firewall_or_ndr_events`

| eval normalized_src_host=coalesce(src_host, source_host, host, dvc_host)

| eval normalized_src_ip=coalesce(src_ip, source_ip, src, private_ip)

| eval normalized_src_asset=coalesce(src_asset_id, asset_id, endpoint_id)

| eval normalized_workload=coalesce(workload_identity, cloud_instance_id, container_id)

| eval normalized_dest_host=coalesce(dest_host, destination_host, url_domain, domain, query)

| eval normalized_dest_ip=coalesce(dest_ip, destination_ip, dest)

| eval normalized_dest_port=coalesce(dest_port, destination_port, dpt)

| eval normalized_time=_time

| lookup ENV_JOOMLA_PUBLIC_ASSETS normalized_src_host OUTPUT joomla_asset_match joomla_site_id asset_role

| lookup ENV_JOOMLA_PUBLIC_ASSETS normalized_src_ip OUTPUT ip_asset_match ip_joomla_site_id ip_asset_role

| lookup ENV_JOOMLA_WORKLOAD_MAP normalized_workload OUTPUT workload_match workload_joomla_site_id workload_role

| lookup ENV_APPROVED_JOOMLA_EGRESS normalized_dest_host OUTPUT approved_dest_host

| lookup ENV_APPROVED_JOOMLA_EGRESS normalized_dest_ip OUTPUT approved_dest_ip

| lookup ENV_APPROVED_JOOMLA_CONTEXT_WINDOWS normalized_time OUTPUT approved_context_window

| where approved_context_window!="true"

| where joomla_asset_match="true"

OR ip_asset_match="true"

OR workload_match="true"

| where isnotnull(normalized_dest_host)

OR isnotnull(normalized_dest_ip)

| where isnull(normalized_dest_host)

OR approved_dest_host!="true"

| where isnull(normalized_dest_ip)

OR approved_dest_ip!="true"

| where destination_first_seen_status IN ("new", "rare")

OR destination_domain_age_days < ENV_NEW_DOMAIN_AGE_DAYS

OR destination_reputation IN ("unknown", "suspicious", "malicious")

OR destination_asn IN ENV_SUSPICIOUS_ASNS

OR destination_geo NOT IN ENV_JOOMLA_EXPECTED_EGRESS_GEOS

OR normalized_dest_port IN ENV_UNUSUAL_JOOMLA_EGRESS_PORTS

OR proxy_action IN ("allowed", "proxied", "connected")

OR firewall_action IN ("allowed", "connected")

| eval event_kind="rare_joomla_host_egress"

| eval candidate_time=normalized_time

| eval correlation_site=coalesce(joomla_site_id, ip_joomla_site_id, workload_joomla_site_id, normalized_src_host, normalized_src_ip, normalized_workload)

| eval correlation_dest=coalesce(normalized_src_host, normalized_src_ip)

| eval correlation_backend=normalized_src_host

| eval correlation_workload=normalized_workload

| fields event_kind candidate_time correlation_site correlation_dest correlation_backend correlation_workload normalized_dest_host normalized_dest_ip normalized_dest_port destination_first_seen_status destination_reputation destination_domain_age_days destination_asn destination_geo proxy_action firewall_action

]

| sort 0 correlation_site candidate_time

| streamstats current=f last(eval(if(event_kind="suspicious_joomla_extension_upload", candidate_time, null()))) as prior_upload_time last(eval(if(event_kind="suspicious_joomla_extension_upload", correlation_site, null()))) as prior_upload_site last(eval(if(event_kind="suspicious_joomla_extension_upload", correlation_dest, null()))) as prior_upload_dest last(eval(if(event_kind="suspicious_joomla_extension_upload", correlation_backend, null()))) as prior_upload_backend last(eval(if(event_kind="suspicious_joomla_extension_upload", correlation_workload, null()))) as prior_upload_workload last(eval(if(event_kind="suspicious_joomla_extension_upload", carry_src_ip, null()))) as prior_upload_src_ip last(eval(if(event_kind="suspicious_joomla_extension_upload", carry_extension_family, null()))) as prior_upload_extension_family by correlation_site

| where event_kind IN ("joomla_writable_php_access", "rare_joomla_host_egress")

| where isnotnull(prior_upload_time)

| where candidate_time >= prior_upload_time

| where (

event_kind="joomla_writable_php_access"

AND candidate_time <= prior_upload_time + ENV_JOOMLA_UPLOAD_TO_PHP_ACCESS_WINDOW_SECONDS

AND (

correlation_site=prior_upload_site

OR correlation_dest=prior_upload_dest

OR correlation_backend=prior_upload_backend

OR correlation_workload=prior_upload_workload

OR normalized_src_ip=prior_upload_src_ip

OR carry_writable_path_family=prior_upload_extension_family

)

)

OR (

event_kind="rare_joomla_host_egress"

AND candidate_time <= prior_upload_time + ENV_JOOMLA_UPLOAD_TO_EGRESS_WINDOW_SECONDS

AND (

correlation_site=prior_upload_site

OR correlation_backend=prior_upload_backend

OR correlation_workload=prior_upload_workload

)

)

| table prior_upload_time candidate_time event_kind prior_upload_site correlation_site prior_upload_dest correlation_dest prior_upload_backend correlation_backend prior_upload_workload correlation_workload prior_upload_src_ip normalized_src_ip prior_upload_extension_family carry_writable_path_family carry_php_path normalized_dest_host normalized_dest_ip normalized_dest_port destination_first_seen_status destination_reputation destination_domain_age_days destination_asn destination_geo proxy_action firewall_action normalized_path normalized_query normalized_status normalized_response_size

Rule

Joomla Web Server Endpoint Execution Correlated With Webshell and CMS Impact Indicators

Rule Format

Splunk SPL correlation pattern requiring endpoint telemetry, Linux audit or file-integrity telemetry where available, Joomla path mapping, web server service-account mapping, approved workflow exceptions, CMS state enrichment, FTP or hosting-control telemetry where available, and downstream SOC triage.

Detection Purpose

Detect Joomla host endpoint behavior consistent with PHP webshell execution, credential access, local staging, suspicious tooling, rare egress, or hosted-content impact after extension upload abuse.

Detection Logic

Trigger when a Joomla web server records suspicious file, process, command-line, sensitive-file, or network activity from web server service context or within Joomla webroot paths outside approved deployment, backup, plugin update, migration, validation, hosting-provider, cleanup, or maintenance workflows.

Assign medium severity when unexpected PHP-like file activity occurs in writable Joomla paths or extension-owned webroot locations.

Assign high severity when web server service-context execution aligns with shell usage, scripting interpreters, transfer tools, archive tools, database tools, encoding tools, Joomla credential-file access, database dump behavior, or rare egress.

Promote to critical when endpoint behavior correlates with suspicious Joomla extension upload activity, web access to a planted PHP-like file, Joomla administrator or Super User creation, FTP activity, hosting-control activity, hosted-content modification, phishing or malware hosting, spam infrastructure, or multi-site compromise.

Required Telemetry

·        Splunk endpoint process telemetry.

·        Splunk endpoint command-line telemetry.

·        Splunk endpoint file telemetry.

·        Splunk endpoint network telemetry.

·        Linux audit logs where available.

·        File-integrity monitoring where available.

·        EDR telemetry where available.

·        Joomla web server asset lookup.

·        Joomla webroot path lookup.

·        Joomla writable-path lookup.

·        Joomla extension-owned path lookup.

·        Web server service-user lookup.

·        Web server process-name lookup.

·        Approved deployment-user lookup.

·        Approved backup-user lookup.

·        Approved migration-user lookup.

·        Approved hosting-provider user lookup.

·        Approved security-tool lookup.

·        Approved maintenance-window lookup.

·        Approved egress-destination lookup.

·        CMS state telemetry where available.

·        FTP telemetry where available.

·        Hosting-control telemetry where available.

·        Web access correlation telemetry where available.

Engineering Implementation Instructions

Normalize endpoint host, endpoint ID, user, process user, process name, parent process name, command line, file path, file name, file extension, event type, destination host, destination IP, destination port, destination domain, event timestamp, Joomla site ID, webroot path, service context, and endpoint network activity.

Create macros for Joomla endpoint events, Joomla web server endpoints, Joomla writable paths, PHP-like file patterns, web server service context, suspicious child processes, sensitive Joomla file access, rare Joomla endpoint egress, approved Joomla endpoint activity, CMS state changes, FTP activity, hosting-control activity, and suspicious hosted-content indicators.

Create lookups for Joomla web servers, Joomla webroots, Joomla writable paths, Joomla extension-owned paths, PHP-like file patterns, sensitive Joomla files, web server service users, web server process names, shell interpreters, scripting interpreters, transfer tools, archive tools, database tools, encoding tools, approved deployment users, approved deployment tools, approved backup tools, approved migration users, approved hosting-provider users, approved security tools, approved maintenance windows, approved validation windows, approved cleanup windows, approved egress destinations, and approved process baselines.

Run the rule in hunt mode before alert mode to baseline Joomla administration, CMS updates, extension updates, image handling, cache generation, backup operations, restore activity, deployment workflows, hosting-provider maintenance, security scanning, incident-response cleanup, and validation activity.

Use scheduled searches, tstats, accelerated data models, or summary indexing where endpoint and file telemetry volume is high.

Treat endpoint grouping, path mapping, service-account mapping, approved workflow exceptions, maintenance-window suppression, rare-egress baselining, and SOC routing as required local deployment work.

DRI Assessment

High resilience where Splunk receives process, command-line, file, endpoint-network, Linux audit, EDR, Joomla path, web server service-user, approved workflow, and outbound enrichment telemetry. Lower resilience where endpoint coverage is unavailable, file telemetry is incomplete, command-line capture is weak, or approved workflows are not baselined.

DRI

8.7 / 10

TCR Assessment

Operational confidence is strong when web server service-context execution aligns with PHP-like writable-path artifacts, sensitive-file access, database access, suspicious tooling, or rare egress. Confidence is highest when endpoint behavior also correlates with suspicious Joomla extension request telemetry, HTTP access to the planted file, CMS state changes, FTP activity, hosting-control activity, or hosted-content impact.

Operational TCR

8.3 / 10

Full-Telemetry TCR

9.2 / 10

Limitations

Endpoint telemetry may not be available in shared-hosting or managed-hosting environments. Legitimate Joomla deployment, backup, restore, plugin update, image processing, vulnerability validation, hosting-provider maintenance, malware scanning, and emergency cleanup activity can resemble suspicious endpoint behavior. Splunk endpoint detections must be scoped to Joomla hosts and tuned against approved workflows. Critical promotion requires correlation beyond endpoint telemetry alone when available.

Detection Query Pattern

Use this pattern as an implementation guide for Splunk environments that support endpoint process, command-line, file, endpoint-network, Linux audit, EDR, Joomla asset, Joomla path, web server service-user, approved workflow, CMS state, FTP, hosting-control, web access, and destination-enrichment correlation. Customer-specific indexes, sourcetypes, field names, CIM mappings, macros, accelerated data sources, summary indexes, and local enrichment should be abstracted behind macros and lookups.

`joomla_endpoint_events`

| eval normalized_endpoint=coalesce(dest, dest_host, host, EndpointName, endpoint, computer_name)

| eval normalized_endpoint_id=coalesce(endpoint_id, agent_id, device_id, aid)

| eval normalized_user=coalesce(user, username, UserName, account)

| eval normalized_process_user=coalesce(process_user, user, UserName, account)

| eval normalized_process=coalesce(process_name, ProcessName, process, image, Image)

| eval normalized_parent=coalesce(parent_process_name, ParentProcessName, parent_process, ParentImage)

| eval normalized_cmd=coalesce(command_line, CommandLine, process_command_line, cmdline)

| eval normalized_file_path=coalesce(file_path, FilePath, path, TargetFilename)

| eval normalized_file_name=coalesce(file_name, FileName, filename)

| eval normalized_event_type=coalesce(event_type, EventType, action, signature)

| eval normalized_dest_host=coalesce(dest_host, DestinationHost, url_domain, domain)

| eval normalized_dest_ip=coalesce(dest_ip, DestinationIp, dest)

| eval normalized_dest_port=coalesce(dest_port, DestinationPort, dpt)

| eval normalized_time=_time

| lookup ENV_JOOMLA_WEB_ENDPOINTS normalized_endpoint OUTPUT joomla_endpoint_match joomla_site_id endpoint_role

| lookup ENV_JOOMLA_WEBROOT_PATHS normalized_file_path OUTPUT webroot_path_match webroot_role

| lookup ENV_JOOMLA_WRITABLE_OR_EXTENSION_PATHS normalized_file_path OUTPUT writable_path_match writable_path_family

| lookup ENV_PHP_LIKE_FILE_PATTERNS normalized_file_name OUTPUT php_file_match php_file_family

| lookup ENV_JOOMLA_WEB_SERVER_SERVICE_USERS normalized_process_user OUTPUT service_user_match

| lookup ENV_JOOMLA_WEB_SERVER_PROCESSES normalized_parent OUTPUT web_parent_match

| lookup ENV_JOOMLA_PHP_RUNTIME_PROCESSES normalized_process OUTPUT php_runtime_match

| lookup ENV_APPROVED_JOOMLA_ENDPOINT_ACTIVITY normalized_user normalized_process normalized_cmd normalized_time OUTPUT approved_endpoint_activity

| lookup ENV_APPROVED_JOOMLA_EGRESS normalized_dest_host OUTPUT approved_dest_host

| lookup ENV_APPROVED_JOOMLA_EGRESS normalized_dest_ip OUTPUT approved_dest_ip

| where joomla_endpoint_match="true"

| where approved_endpoint_activity!="true"

| eval joomla_web_server_context=if(service_user_match="true" OR web_parent_match="true" OR php_runtime_match="true" OR match(normalized_cmd, ENV_JOOMLA_WEB_SERVER_RUNTIME_PATTERNS), "true", "false")

| eval php_like_file_activity=if(php_file_match="true" AND normalized_event_type IN ("file_created", "file_modified", "file_renamed", "file_written"), "true", "false")

| eval suspicious_web_server_child_process=if(joomla_web_server_context="true" AND (normalized_process IN ENV_SHELL_INTERPRETERS OR normalized_process IN ENV_SCRIPTING_INTERPRETERS OR normalized_process IN ENV_TRANSFER_TOOLS OR normalized_process IN ENV_ARCHIVE_TOOLS OR normalized_process IN ENV_NETWORK_TOOLS OR normalized_process IN ENV_DATABASE_TOOLS OR normalized_process IN ENV_ENCODING_OR_OBFUSCATION_TOOLS OR match(normalized_cmd, ENV_WEB_SERVER_SUSPICIOUS_COMMAND_PATTERNS) OR match(normalized_cmd, ENV_JOOMLA_CREDENTIAL_ACCESS_COMMAND_PATTERNS) OR match(normalized_cmd, ENV_JOOMLA_DISCOVERY_COMMAND_PATTERNS)), "true", "false")

| lookup ENV_SENSITIVE_JOOMLA_FILE_PATTERNS normalized_file_path OUTPUT sensitive_file_match sensitive_file_role

| eval sensitive_joomla_file_access=if(sensitive_file_match="true" AND normalized_event_type IN ("file_opened", "file_read", "file_modified", "file_copied", "file_archived"), "true", "false")

| eval rare_joomla_endpoint_egress=if((isnotnull(normalized_dest_host) OR isnotnull(normalized_dest_ip)) AND (isnull(normalized_dest_host) OR approved_dest_host!="true") AND (isnull(normalized_dest_ip) OR approved_dest_ip!="true") AND (destination_first_seen_status IN ("new", "rare") OR destination_domain_age_days < ENV_NEW_DOMAIN_AGE_DAYS OR destination_reputation IN ("unknown", "suspicious", "malicious") OR destination_asn IN ENV_SUSPICIOUS_ASNS OR destination_geo NOT IN ENV_JOOMLA_EXPECTED_EGRESS_GEOS OR normalized_dest_port IN ENV_UNUSUAL_JOOMLA_EGRESS_PORTS), "true", "false")

| where (

(

writable_path_match="true"

AND php_like_file_activity="true"

)

OR suspicious_web_server_child_process="true"

OR sensitive_joomla_file_access="true"

OR rare_joomla_endpoint_egress="true"

)

| where joomla_web_server_context="true"

OR webroot_path_match="true"

OR match(normalized_cmd, ENV_JOOMLA_WEBROOT_COMMAND_PATTERNS)

OR rare_joomla_endpoint_egress="true"

| where (

(

isnotnull(normalized_file_path)

AND normalized_file_path NOT IN ENV_APPROVED_JOOMLA_FILE_PATHS

)

OR (

isnotnull(normalized_cmd)

AND NOT match(normalized_cmd, ENV_APPROVED_JOOMLA_COMMAND_PATTERNS)

)

OR (

isnotnull(normalized_dest_host)

AND approved_dest_host!="true"

)

OR (

isnotnull(normalized_dest_ip)

AND approved_dest_ip!="true"

)

OR (

isnotnull(normalized_process)

AND normalized_process NOT IN ENV_APPROVED_JOOMLA_PROCESS_BASELINE

)

)

| eval event_kind="joomla_endpoint_webshell_or_cms_impact_candidate"

| table normalized_time normalized_endpoint normalized_endpoint_id joomla_site_id normalized_user normalized_process_user normalized_process normalized_parent normalized_cmd normalized_file_path normalized_file_name normalized_event_type webroot_path_match writable_path_match writable_path_family php_file_match php_file_family joomla_web_server_context suspicious_web_server_child_process sensitive_joomla_file_access rare_joomla_endpoint_egress normalized_dest_host normalized_dest_ip normalized_dest_port destination_first_seen_status destination_reputation destination_domain_age_days destination_asn destination_geo event_kind

Elastic

Detection Viability Assessment

Production-deployable where Elastic receives WAF, reverse-proxy, CDN, load-balancer, web access, DNS, proxy, firewall, endpoint, EDR, Linux audit, file-integrity, Joomla asset inventory, Joomla extension inventory, and local enrichment data. Elastic can support both web-layer sequence logic and endpoint-consequence detection when customer-specific data streams, ECS mappings, transforms, enrichment policies, value lists, exception lists, and local enriched fields are implemented. This rule set should be deployed as behavior-based correlation logic, not as CVE-specific matching.

Rule

Joomla Extension Upload Abuse Correlated With Writable PHP Access or Rare Egress

Rule Format

Elastic EQL-style sequence and correlation pattern requiring local ECS mapping, Joomla asset enrichment, extension-route enrichment, writable-path enrichment, approved-source exceptions, egress-destination enrichment, Joomla site-ID enrichment, and maintenance-window exception handling.

Detection Purpose

Detect suspicious Joomla extension upload, profile-import, custom-icon upload, asset upload, image upload, media upload, or AJAX upload activity that correlates with PHP-like file access in writable Joomla paths or rare outbound communication from the same Joomla site, backend host, asset, or workload.

Detection Logic

Trigger when a Joomla asset receives suspicious POST activity against Joomla extension upload or import behavior from a source that is not an approved Joomla administrator source, approved scanner, approved hosting-provider support source, approved validation source, approved deployment source, or approved maintenance workflow.

Assign medium severity when suspicious Joomla extension upload or import activity occurs without follow-on execution or egress evidence.

Assign high severity when suspicious Joomla extension upload or import activity is followed by HTTP access to a PHP-like file in Joomla writable, media, image, upload, tmp, cache, asset, iconfont, gfonts, template, plugin, component, module, or extension-owned webroot paths.

Assign high severity when suspicious Joomla extension upload or import activity aligns with unusual source context, suspicious user agent, abnormal response-size behavior, repeated failure-to-success behavior, or abnormal HTTP status sequencing.

Promote to critical when suspicious Joomla extension upload or import activity is followed by rare egress from the Joomla host, endpoint-confirmed web server process execution, credential-file access, database access, Joomla administrator or Super User creation, FTP activity, hosting-control activity, hosted-content tampering, phishing or malware hosting, spam infrastructure, or confirmed webshell artifact discovery.

Required Telemetry

·        Elastic WAF logs.

·        Elastic reverse-proxy logs.

·        Elastic CDN logs where applicable.

·        Elastic load-balancer logs.

·        Elastic web access logs.

·        Elastic DNS logs.

·        Elastic proxy logs.

·        Elastic firewall logs.

·        Elastic endpoint telemetry where available.

·        Elastic Defend telemetry where available.

·        Linux audit or file-integrity telemetry where available.

·        Joomla asset inventory enrichment.

·        Joomla extension inventory enrichment.

·        Joomla virtual-host to backend-host mapping.

·        Joomla site to workload mapping where applicable.

·        Backend-host to private-IP mapping.

·        Joomla site-ID enrichment for web, endpoint, DNS, proxy, firewall, and NDR telemetry.

·        Approved Joomla administrator source value list.

·        Approved Joomla scanner value list.

·        Approved hosting-provider support-source value list.

·        Approved Joomla validation-source value list.

·        Approved deployment-source value list.

·        Approved maintenance-window exception logic.

·        Approved egress-destination value list.

·        Recently seen destination-domain baseline.

·        Destination reputation enrichment where available.

Engineering Implementation Instructions

Map HTTP method, URI path, query string, full URL, source IP, forwarded source IP, user agent, HTTP status, request size, response size, virtual host, destination host, backend host, private IP, Joomla site ID, extension family, destination domain, destination IP, destination port, DNS query, proxy action, firewall action, event timestamp, and workload identity into local Elastic fields.

Create enrichment policies or transforms for Joomla public assets, Joomla virtual-host to backend-host mapping, Joomla workload mapping, Joomla site-ID mapping, Joomla extension upload routes, Joomla writable paths, PHP-like web artifact paths, approved Joomla source exceptions, approved maintenance windows, approved egress destinations, rare destination baselines, and destination reputation.

Validate that URI paths and query strings are preserved before enabling extension-route detection.

Validate that virtual host, backend host, private IP, asset ID, site ID, and workload identity can correlate inbound web activity to outbound DNS, proxy, firewall, NDR, or endpoint telemetry before enabling critical-severity promotion.

Validate that all events participating in the sequence are enriched with joomla.site.id before enabling the sequence rule.

Use value lists for approved administrators, scanner sources, hosting-provider support sources, deployment sources, validation sources, approved egress destinations, and known business domains.

Use exception lists for approved maintenance windows, change-control windows, emergency remediation windows, malware cleanup windows, and vulnerability-validation windows.

Treat ECS mapping, enrichment policy ownership, transform freshness, exception-list ownership, source-IP preservation, query-string preservation, Joomla site-ID enrichment, asset identity joins, maintenance-window suppression, rare-egress baselining, and SOC routing as required local deployment work.

DRI Assessment

High resilience where Elastic has normalized web telemetry, URI paths, query strings, Joomla asset enrichment, Joomla site-ID enrichment, extension-route enrichment, writable-path enrichment, approved-source context, maintenance-window context, and outbound telemetry joins. Lower resilience where web telemetry omits query strings, virtual-host mapping is incomplete, source-IP preservation is inconsistent, writable-path enrichment is incomplete, Joomla site-ID enrichment is unavailable, or egress telemetry cannot be joined back to the affected Joomla asset.

DRI

8.8 / 10

TCR Assessment

Operational confidence is strong when suspicious Joomla extension upload behavior correlates with writable-path PHP access or rare egress. Confidence is highest when Elastic also receives endpoint execution, sensitive-file access, CMS state, FTP, hosting-control, or artifact-confirmation telemetry.

Operational TCR

8.4 / 10

Full-Telemetry TCR

9.3 / 10

Limitations

Elastic cannot reliably detect Joomla extension upload abuse from pure flow telemetry or web telemetry that omits URI paths and query strings. Customer-specific ECS mappings, data streams, enrichment policies, transforms, value lists, and exception lists must be implemented locally. The sequence rule requires Joomla site-ID enrichment across both web telemetry and DNS, proxy, firewall, NDR, or endpoint telemetry. Legitimate Joomla administration, plugin updates, media uploads, deployment workflows, vulnerability validation, hosting-provider support, malware cleanup, and emergency remediation may resemble suspicious activity. Critical promotion depends on reliable correlation between web request telemetry and endpoint, DNS, proxy, firewall, CMS, FTP, hosting-control, or artifact evidence.

Detection Query Pattern

Use this pattern as an implementation guide for Elastic environments that support WAF, reverse-proxy, CDN, load-balancer, web access, DNS, proxy, firewall, endpoint, Joomla asset, Joomla extension, Joomla site-ID enrichment, source-enrichment, destination-enrichment, writable-path enrichment, and maintenance-window correlation. Customer-specific data streams, index names, field names, ECS mappings, transforms, enrichment policies, value lists, exception lists, and local enriched field names should be implemented locally. The field names below are neutral implementation placeholders and must be mapped to the customer’s Elastic schema.

sequence by joomla.site.id with maxspan=ENV_JOOMLA_UPLOAD_TO_EGRESS_WINDOW

[ any where

event.dataset : ENV_JOOMLA_WEB_HTTP_DATASET_PATTERN and

joomla.asset.public == true and

joomla.site.id != null and

http.request.method == "POST" and

exception.approved_joomla_admin_source != true and

exception.approved_joomla_scanner != true and

exception.approved_hosting_provider_support_source != true and

exception.approved_joomla_validation_source != true and

exception.approved_joomla_deployment_source != true and

exception.approved_joomla_maintenance_window != true and

(

joomla.extension.upload_route_match == true or

(

url.query : "*option=com_jce*" and

url.query : "*task=profiles.import*"

) or

(

(

url.query : "*option=com_sppagebuilder*" or

url.path : "*/com_sppagebuilder/*" or

url.path : "*/sppagebuilder/*"

) and

(

url.query : "*task=asset.uploadCustomIcon*" or

url.path : "*asset.uploadCustomIcon*" or

url.path : "*uploadCustomIcon*"

)

) or

(

(

url.query : "*option=com_pagebuilderck*" or

url.path : "*/com_pagebuilderck/*" or

url.path : "*/pagebuilderck/*"

) and

(

url.query : "*browse.ajaxAddPicture*" or

url.path : "*browse.ajaxAddPicture*" or

url.path : "*ajaxAddPicture*"

)

)

) and

(

source.first_seen.status in ("new", "rare") or

source.network.type in ("cloud_hosted", "residential_proxy", "vpn_provider", "scanner_infrastructure", "unknown_hosting") or

baseline.joomla.expected_source_geo_match != true or

user_agent.original in ENV_RARE_OR_AUTOMATED_USER_AGENTS or

http.request.mime_type in ("multipart/form-data", "application/zip", "application/octet-stream") or

http.request.bytes > ENV_JOOMLA_EXTENSION_UPLOAD_REQUEST_SIZE_BASELINE or

http.response.bytes > ENV_JOOMLA_EXTENSION_UPLOAD_RESPONSE_SIZE_UPPER_BASELINE or

http.response.bytes < ENV_JOOMLA_EXTENSION_UPLOAD_RESPONSE_SIZE_LOWER_BASELINE or

joomla.request.timing_pattern in ("rapid_retry", "automation_like", "low_and_slow_probe", "failed_then_successful_upload") or

joomla.http.status_sequence in ("repeated_errors", "errors_then_success", "upload_success_after_errors", "abnormal_redirect_sequence")

)

]

[ any where

(

(

event.dataset : ENV_JOOMLA_WEB_HTTP_DATASET_PATTERN and

joomla.asset.public == true and

joomla.site.id != null and

http.request.method in ("GET", "POST") and

exception.approved_joomla_maintenance_window != true and

joomla.path.writable_or_extension_owned == true and

joomla.path.php_like_web_artifact == true and

(

http.response.status_code in (200, 206, 302, 403, 404, 500) or

joomla.response.size_delta_above_baseline == true or

joomla.request.timing_pattern in ("single_probe_then_repeat", "interactive_webshell_like", "low_volume_callback_test") or

user_agent.original in ENV_RARE_OR_AUTOMATED_USER_AGENTS

)

) or

(

event.dataset : ENV_JOOMLA_DNS_PROXY_FIREWALL_OR_NDR_DATASET_PATTERN and

joomla.site.id != null and

(

source.host.name in ENV_JOOMLA_PUBLIC_ASSETS or

source.ip in ENV_JOOMLA_PUBLIC_ASSETS or

source.asset.id in ENV_JOOMLA_PUBLIC_ASSETS or

source.workload.id in ENV_JOOMLA_PUBLIC_ASSETS

) and

exception.approved_joomla_maintenance_window != true and

(

destination.domain != null or

destination.ip != null

) and

(

destination.domain == null or

destination.domain not in ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS

) and

(

destination.ip == null or

destination.ip not in ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS

) and

(

destination.first_seen.status in ("new", "rare") or

destination.domain.age_days < ENV_NEW_DOMAIN_AGE_DAYS or

destination.reputation in ("unknown", "suspicious", "malicious") or

destination.as.number in ENV_SUSPICIOUS_ASNS or

baseline.joomla.expected_destination_geo_match != true or

destination.port in ENV_UNUSUAL_JOOMLA_EGRESS_PORTS or

network.proxy.action in ("allowed", "proxied", "connected") or

network.firewall.action in ("allowed", "connected")

)

)

) and

(

correlation.same_joomla_site == true or

correlation.same_destination_host == true or

correlation.same_backend_host == true or

correlation.same_workload == true or

correlation.same_source_ip == true or

correlation.same_writable_path_family == true or

correlation.same_uploaded_path == true

)

]

Rule

Joomla Web Server Endpoint Execution With Writable PHP Artifact or Rare Egress

Rule Format

Elastic EQL-style endpoint detection pattern requiring local ECS mapping, Elastic Defend or EDR telemetry, file telemetry, process telemetry, network telemetry, Joomla endpoint enrichment, Joomla path enrichment, web server service-context enrichment, approved workflow exceptions, and destination enrichment.

Detection Purpose

Detect Joomla host endpoint behavior consistent with PHP webshell execution after extension upload abuse, including PHP-like file creation in writable Joomla paths, web server service-context execution, sensitive Joomla file access, command execution, transfer-tool use, archive activity, encoding behavior, database access, or rare outbound communication.

Detection Logic

Trigger when a Joomla web server records PHP-like file creation, modification, rename, or write activity in writable Joomla or extension-owned webroot paths outside approved deployment, maintenance, update, backup, migration, validation, cleanup, hosting-provider, or security-tool workflows.

Assign medium severity when unexpected PHP-like file activity occurs in Joomla writable, media, image, upload, tmp, cache, asset, iconfont, gfonts, template, plugin, component, module, or extension-owned paths.

Assign high severity when PHP-like file activity aligns with web server service-context execution, shell invocation, scripting interpreter use, transfer-tool activity, archive-tool activity, encoded command behavior, sensitive Joomla file access, database dump activity, or rare outbound communication.

Promote to critical when endpoint behavior is correlated with suspicious Joomla extension upload or import activity, HTTP access to the planted PHP-like file, confirmed webshell artifact discovery, Joomla administrator or Super User creation, credential-file access, database access, FTP or hosting-control abuse, hosted-content tampering, phishing or malware hosting, spam infrastructure, or multi-site compromise.

Required Telemetry

·        Elastic endpoint process telemetry.

·        Elastic endpoint parent-process telemetry.

·        Elastic endpoint command-line telemetry.

·        Elastic endpoint file telemetry.

·        Elastic endpoint network telemetry.

·        Elastic Defend or EDR telemetry where available.

·        Linux audit logs where available.

·        File-integrity monitoring where available.

·        Joomla endpoint enrichment.

·        Joomla webroot path enrichment.

·        Joomla writable-path enrichment.

·        Joomla extension-owned path enrichment.

·        Web server service-user enrichment.

·        Web server process-name enrichment.

·        Approved deployment-user exception list.

·        Approved backup-user exception list.

·        Approved migration-user exception list.

·        Approved hosting-provider user exception list.

·        Approved security-tool exception list.

·        Approved maintenance-window exception logic.

·        Approved egress-destination value list.

·        CMS state telemetry where available.

·        FTP telemetry where available.

·        Hosting-control telemetry where available.

·        Web access correlation telemetry where available.

Engineering Implementation Instructions

Map host name, host ID, user name, process user, process name, parent process name, command line, file path, file name, file extension, event action, event category, destination domain, destination IP, destination port, event timestamp, Joomla site ID, webroot path, service context, and endpoint network activity into local Elastic fields.

Create enrichment policies or transforms for Joomla web endpoints, Joomla webroots, Joomla writable paths, Joomla extension-owned paths, PHP-like file patterns, sensitive Joomla files, web server service users, web server process names, shell interpreters, scripting interpreters, transfer tools, archive tools, database tools, encoding tools, approved deployment users, approved deployment tools, approved backup tools, approved migration users, approved hosting-provider users, approved security tools, approved maintenance windows, approved validation windows, approved cleanup windows, approved egress destinations, and approved process baselines.

Run the rule in hunt mode before alert mode to baseline Joomla administration, CMS updates, extension updates, image handling, cache generation, backup operations, restore activity, deployment workflows, hosting-provider maintenance, security scanning, incident-response cleanup, and validation activity.

Use threshold rules, EQL sequences, transform-backed correlation, or event correlation where endpoint and file telemetry volume is high.

Treat endpoint grouping, path enrichment, service-account mapping, approved workflow exceptions, maintenance-window suppression, rare-egress baselining, ECS mapping, exception-list ownership, and SOC routing as required local deployment work.

DRI Assessment

High resilience where Elastic receives process, command-line, file, endpoint-network, Linux audit, EDR, Joomla path, web server service-user, approved workflow, and outbound enrichment telemetry. Lower resilience where endpoint coverage is unavailable, file telemetry is incomplete, command-line capture is weak, or approved workflows are not baselined.

DRI

8.6 / 10

TCR Assessment

Operational confidence is strong when web server service-context execution aligns with PHP-like writable-path artifacts, sensitive-file access, database access, suspicious tooling, or rare egress. Confidence is highest when endpoint behavior also correlates with suspicious Joomla extension request telemetry, HTTP access to the planted file, CMS state changes, FTP activity, hosting-control activity, or hosted-content impact.

Operational TCR

8.2 / 10

Full-Telemetry TCR

9.1 / 10

Limitations

Endpoint telemetry may not be available in shared-hosting or managed-hosting environments. Elastic field names, ECS mappings, transforms, enrichment policies, value lists, and exception lists must be implemented locally. Legitimate Joomla deployment, backup, restore, plugin update, image processing, vulnerability validation, hosting-provider maintenance, malware scanning, and emergency cleanup activity can resemble suspicious endpoint behavior. Elastic endpoint detections must be scoped to Joomla hosts and tuned against approved workflows. Critical promotion requires correlation beyond endpoint telemetry alone when available.

Detection Query Pattern

Use this pattern as an implementation guide for Elastic environments that support endpoint process, command-line, file, endpoint-network, Linux audit, EDR, Joomla asset, Joomla path, web server service-user, approved workflow, CMS state, FTP, hosting-control, web access, and destination-enrichment correlation. Customer-specific data streams, index names, field names, ECS mappings, transforms, enrichment policies, value lists, exception lists, and local enriched field names should be implemented locally. The field names below are neutral implementation placeholders and must be mapped to the customer’s Elastic schema.

any where

event.dataset : ENV_JOOMLA_ENDPOINT_DATASET_PATTERN and

joomla.endpoint.web_server == true and

exception.approved_joomla_endpoint_activity != true and

(

(

joomla.path.writable_or_extension_owned == true and

file.name : ENV_PHP_LIKE_FILE_PATTERNS and

event.action in ("file_created", "file_modified", "file_renamed", "file_written")

) or

(

joomla.web_server.context == true and

(

process.name in ENV_SHELL_INTERPRETERS or

process.name in ENV_SCRIPTING_INTERPRETERS or

process.name in ENV_TRANSFER_TOOLS or

process.name in ENV_ARCHIVE_TOOLS or

process.name in ENV_NETWORK_TOOLS or

process.name in ENV_DATABASE_TOOLS or

process.name in ENV_ENCODING_OR_OBFUSCATION_TOOLS or

process.command_line : ENV_WEB_SERVER_SUSPICIOUS_COMMAND_PATTERNS or

process.command_line : ENV_JOOMLA_CREDENTIAL_ACCESS_COMMAND_PATTERNS or

process.command_line : ENV_JOOMLA_DISCOVERY_COMMAND_PATTERNS

)

) or

(

file.path : ENV_SENSITIVE_JOOMLA_FILE_PATTERNS and

event.action in ("file_opened", "file_read", "file_modified", "file_copied", "file_archived")

) or

(

(

destination.domain != null or

destination.ip != null

) and

(

destination.domain == null or

destination.domain not in ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS

) and

(

destination.ip == null or

destination.ip not in ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS

) and

(

destination.first_seen.status in ("new", "rare") or

destination.domain.age_days < ENV_NEW_DOMAIN_AGE_DAYS or

destination.reputation in ("unknown", "suspicious", "malicious") or

destination.as.number in ENV_SUSPICIOUS_ASNS or

baseline.joomla.expected_destination_geo_match != true or

destination.port in ENV_UNUSUAL_JOOMLA_EGRESS_PORTS

)

)

) and

(

joomla.web_server.context == true or

joomla.path.webroot == true or

process.command_line : ENV_JOOMLA_WEBROOT_COMMAND_PATTERNS or

network.joomla.rare_egress == true

) and

(

(

file.path != null and

file.path not in ENV_APPROVED_JOOMLA_FILE_PATHS

) or

(

process.command_line != null and

process.command_line not in ENV_APPROVED_JOOMLA_COMMAND_PATTERNS

) or

(

destination.domain != null and

destination.domain not in ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS

) or

(

destination.ip != null and

destination.ip not in ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS

) or

(

process.name != null and

process.name not in ENV_APPROVED_JOOMLA_PROCESS_BASELINE

)

)

QRadar

Detection Viability Assessment

Production-deployable where QRadar receives WAF, reverse-proxy, CDN, load-balancer, web access, DNS, proxy, firewall, endpoint, EDR, Linux audit, file-integrity, Joomla asset inventory, Joomla extension inventory, and local enrichment data. QRadar is well suited for this threat when suspicious Joomla extension upload activity can be correlated to writable-path PHP access, rare outbound communication, endpoint execution, sensitive-file access, CMS state changes, FTP activity, hosting-control activity, or hosted-content impact. This rule should be implemented as an offense model using building blocks, reference sets, reference maps, custom properties, DSM field mappings, and tuned time windows.

Rule

Joomla Extension Upload Abuse With PHP Webshell Execution or Rare Egress

Rule Format

QRadar offense correlation model using building blocks for suspicious Joomla extension upload activity, writable PHP web access, and Joomla host endpoint or egress impact.

Detection Purpose

Detect suspicious Joomla extension upload, profile-import, custom-icon upload, asset upload, image upload, media upload, or AJAX upload activity that correlates with PHP-like file access, rare egress, web server service-context execution, sensitive Joomla file access, database access, FTP activity, hosting-control activity, or hosted-content impact.

Detection Logic

Trigger when suspicious Joomla extension upload or import behavior is observed on a Joomla public asset from a source that is not an approved Joomla administrator, scanner, hosting-provider support source, validation source, deployment source, maintenance workflow, or approved business source.

Assign medium severity when suspicious Joomla extension upload or import behavior occurs without confirmed execution, egress, endpoint, or hosted-content impact evidence.

Assign high severity when suspicious Joomla extension upload or import behavior is followed by HTTP access to a PHP-like file in Joomla writable, media, image, upload, tmp, cache, asset, iconfont, gfonts, template, plugin, component, module, or extension-owned webroot paths.

Assign high severity when suspicious Joomla extension upload or import behavior is followed by rare outbound communication from the Joomla host, endpoint process execution from web server service context, sensitive Joomla credential-file access, database-tool activity, archive activity, transfer-tool use, or suspicious command execution.

Promote to critical when the offense includes confirmed webshell artifact evidence, Joomla administrator or Super User creation, credential-file access, database dump behavior, FTP abuse, hosting-control abuse, hosted-content tampering, phishing or malware hosting, spam infrastructure, or multi-site compromise.

Required Telemetry

·        QRadar WAF events.

·        QRadar reverse-proxy events.

·        QRadar CDN events where applicable.

·        QRadar load-balancer events.

·        QRadar web access events.

·        QRadar DNS events.

·        QRadar proxy events.

·        QRadar firewall events.

·        QRadar endpoint or EDR events where available.

·        Linux audit or file-integrity events where available.

·        Joomla public asset reference set.

·        Joomla site-to-host reference map.

·        Joomla virtual-host to backend-host reference map.

·        Joomla site-to-workload reference map where applicable.

·        Joomla extension upload route reference set.

·        Joomla writable-path reference set.

·        Joomla PHP-like artifact reference set.

·        Joomla sensitive-file reference set.

·        Joomla web server service-user reference set.

·        Joomla web server process reference set.

·        Approved Joomla administrator source reference set.

·        Approved Joomla scanner source reference set.

·        Approved hosting-provider support-source reference set.

·        Approved validation-source reference set.

·        Approved deployment-source reference set.

·        Approved maintenance-window reference set or rule exception.

·        Approved egress-destination reference set.

·        Destination reputation enrichment where available.

·        Recently seen destination-domain reference map where available.

Engineering Implementation Instructions

Create QRadar custom properties for Joomla site ID, Joomla public asset identity, virtual host, backend host, workload identity, HTTP method, URI path, query string, full URL, source IP, forwarded source IP, user agent, HTTP status, request size, response size, content type, extension family, writable path family, PHP-like artifact path, destination domain, destination IP, destination port, process name, parent process name, process user, command line, file path, file name, file event action, event timestamp, and hosted-content impact indicators.

Create Building Block 1 for suspicious Joomla extension upload or import activity.

Create Building Block 2 for writable-path PHP web access after suspicious Joomla extension upload activity.

Create Building Block 3 for Joomla host rare egress, endpoint execution, sensitive-file access, database access, FTP activity, hosting-control activity, or hosted-content impact after suspicious Joomla extension upload activity.

Create reference sets for Joomla public assets, Joomla web servers, Joomla extension upload routes, JCE profile-import routes, SP Page Builder upload routes, Page Builder CK upload routes, generic Joomla media upload routes, AJAX upload routes, Joomla writable paths, Joomla extension-owned paths, PHP-like artifact patterns, sensitive Joomla files, web server service users, web server processes, suspicious tooling, approved administrator sources, approved scanner sources, approved hosting-provider support sources, approved validation sources, approved deployment sources, approved egress destinations, approved process baselines, approved file paths, approved command patterns, and approved maintenance windows.

Create reference maps for Joomla site to public asset, Joomla site to backend host, Joomla virtual host to backend host, Joomla site to workload identity, Joomla site to expected source geos, Joomla site to expected destination geos, Joomla host to approved egress destinations, Joomla host to response-size baselines, Joomla site to upload-size baselines, and user or service account to approved source context where applicable.

Validate that QRadar receives URI path and query-string fields before enabling extension-route logic.

Validate that Joomla site ID, public asset identity, backend host, private IP, and workload identity can correlate web activity to DNS, proxy, firewall, NDR, endpoint, FTP, hosting-control, or hosted-content telemetry.

Tune rule thresholds and time windows against normal Joomla administration, CMS updates, extension updates, media uploads, template changes, backup operations, restore activity, migrations, vulnerability validation, hosting-provider maintenance, malware cleanup, and emergency remediation.

Treat DSM mapping, custom property extraction, reference-set ownership, reference-map freshness, source-IP preservation, URI preservation, query-string preservation, Joomla site-ID mapping, maintenance-window suppression, and SOC routing as required local deployment work.

DRI Assessment

High resilience where QRadar has normalized web telemetry, URI paths, query strings, Joomla asset identity, Joomla site-ID mapping, extension-route reference sets, writable-path reference sets, approved-source context, maintenance-window context, endpoint telemetry, and outbound telemetry joins. Lower resilience where QRadar lacks query strings, custom properties are incomplete, Joomla site mapping is weak, endpoint telemetry is unavailable, or DNS, proxy, firewall, and NDR telemetry cannot be tied back to the affected Joomla host.

DRI

8.5 / 10

TCR Assessment

Operational confidence is strong when suspicious Joomla extension upload behavior correlates with writable-path PHP access, rare egress, web server service-context execution, sensitive-file access, database access, or hosted-content impact. Confidence is highest when QRadar can join web telemetry, endpoint telemetry, outbound telemetry, CMS state changes, FTP activity, hosting-control activity, and artifact-confirmation evidence into a single offense.

Operational TCR

8.1 / 10

Full-Telemetry TCR

9.0 / 10

Limitations

QRadar cannot reliably detect Joomla extension upload abuse from flow-only telemetry or web telemetry that omits URI paths and query strings. Customer-specific DSM mappings, custom properties, reference sets, reference maps, building blocks, time windows, and offense routing must be implemented locally. Shared-hosting and managed-hosting environments may not expose endpoint telemetry. Legitimate Joomla administration, plugin updates, media uploads, backup jobs, restore jobs, vulnerability validation, hosting-provider support, malware cleanup, and emergency remediation may resemble suspicious activity. Critical promotion requires correlation beyond the upload event alone.

Detection Query Pattern

Use this pattern as implementation-ready QRadar correlation pseudologic and map all custom properties, reference sets, reference maps, DSM fields, building blocks, and time windows to the target QRadar environment before deployment.

BUILDING BLOCK 1: Suspicious Joomla Extension Upload or Import Activity

WHEN events are detected for the same Joomla_Site_ID, same Public_Joomla_Asset, same Virtual_Host, same Backend_Host, same Workload_ID, same Source_IP, or equivalent normalized Joomla asset lineage

WITHIN ENV_JOOMLA_EXTENSION_UPLOAD_HUNT_WINDOW

AND Joomla_Site_ID is not null

AND Public_Joomla_Asset is contained in reference set ENV_PUBLIC_JOOMLA_ASSETS

AND HTTP_Method equals POST

AND Source_IP is not contained in reference set ENV_APPROVED_JOOMLA_ADMIN_SOURCES

AND Source_IP is not contained in reference set ENV_APPROVED_JOOMLA_SCANNER_SOURCES

AND Source_IP is not contained in reference set ENV_APPROVED_HOSTING_PROVIDER_SUPPORT_SOURCES

AND Source_IP is not contained in reference set ENV_APPROVED_JOOMLA_VALIDATION_SOURCES

AND Source_IP is not contained in reference set ENV_APPROVED_JOOMLA_DEPLOYMENT_SOURCES

AND Event_Time is not contained in reference set ENV_APPROVED_JOOMLA_MAINTENANCE_WINDOWS

AND (

Request_Path is contained in reference set ENV_JOOMLA_EXTENSION_UPLOAD_ROUTES

OR (

Request_Query contains "option=com_jce"

AND Request_Query contains "task=profiles.import"

)

OR (

(

Request_Query contains "option=com_sppagebuilder"

OR Request_Path contains "/com_sppagebuilder/"

OR Request_Path contains "/sppagebuilder/"

)

AND (

Request_Query contains "task=asset.uploadCustomIcon"

OR Request_Path contains "asset.uploadCustomIcon"

OR Request_Path contains "uploadCustomIcon"

)

)

OR (

(

Request_Query contains "option=com_pagebuilderck"

OR Request_Path contains "/com_pagebuilderck/"

OR Request_Path contains "/pagebuilderck/"

)

AND (

Request_Query contains "browse.ajaxAddPicture"

OR Request_Path contains "browse.ajaxAddPicture"

OR Request_Path contains "ajaxAddPicture"

)

)

)

AND (

Source_First_Seen_Status is contained in reference set ENV_NEW_OR_RARE_SOURCE_STATES

OR Source_Network_Type is contained in reference set ENV_SUSPICIOUS_SOURCE_NETWORK_TYPES

OR Source_Geo is not contained in reference map ENV_JOOMLA_EXPECTED_SOURCE_GEOS for Joomla_Site_ID

OR User_Agent is contained in reference set ENV_RARE_OR_AUTOMATED_USER_AGENTS

OR Content_Type is contained in reference set ENV_UPLOAD_OR_ARCHIVE_CONTENT_TYPES

OR Request_Size is greater than reference map ENV_JOOMLA_EXTENSION_UPLOAD_REQUEST_SIZE_BASELINE for Joomla_Site_ID

OR Response_Size is greater than reference map ENV_JOOMLA_EXTENSION_UPLOAD_RESPONSE_SIZE_UPPER_BASELINE for Joomla_Site_ID

OR Response_Size is less than reference map ENV_JOOMLA_EXTENSION_UPLOAD_RESPONSE_SIZE_LOWER_BASELINE for Joomla_Site_ID

OR Request_Timing_Pattern is contained in reference set ENV_SUSPICIOUS_JOOMLA_REQUEST_TIMING_PATTERNS

OR HTTP_Status_Sequence is contained in reference set ENV_JOOMLA_ABNORMAL_STATUS_SEQUENCES

)

THEN mark event as Building_Block_Joomla_Suspicious_Extension_Upload

BUILDING BLOCK 2: Writable PHP Web Access After Joomla Extension Upload

WHEN events are detected for the same Joomla_Site_ID, same Public_Joomla_Asset, same Virtual_Host, same Backend_Host, same Workload_ID, same Source_IP, same Writable_Path_Family, same Uploaded_Path, or equivalent normalized Joomla asset lineage

WITHIN ENV_JOOMLA_UPLOAD_TO_PHP_ACCESS_WINDOW

AND Building_Block_Joomla_Suspicious_Extension_Upload occurred before Writable_PHP_Access_Time

AND Writable_PHP_Access_Time occurs within ENV_JOOMLA_UPLOAD_TO_PHP_ACCESS_WINDOW after Suspicious_Extension_Upload_Time

AND Joomla_Site_ID is not null

AND Public_Joomla_Asset is contained in reference set ENV_PUBLIC_JOOMLA_ASSETS

AND HTTP_Method is contained in reference set ENV_HTTP_GET_OR_POST_METHODS

AND Event_Time is not contained in reference set ENV_APPROVED_JOOMLA_MAINTENANCE_WINDOWS

AND Request_Path is contained in reference set ENV_JOOMLA_WRITABLE_OR_EXTENSION_OWNED_PATHS

AND Request_Path is contained in reference set ENV_PHP_LIKE_WEB_ARTIFACT_PATTERNS

AND (

HTTP_Status_Code is contained in reference set ENV_JOOMLA_PHP_ACCESS_STATUS_CODES

OR Response_Size_Delta is greater than reference map ENV_JOOMLA_PHP_ACCESS_RESPONSE_SIZE_DELTA_BASELINE for Joomla_Site_ID

OR Request_Timing_Pattern is contained in reference set ENV_JOOMLA_WEBSHELL_LIKE_TIMING_PATTERNS

OR User_Agent is contained in reference set ENV_RARE_OR_AUTOMATED_USER_AGENTS

)

AND (

Joomla_Site_ID equals Prior_Upload_Joomla_Site_ID

OR Public_Joomla_Asset equals Prior_Upload_Public_Joomla_Asset

OR Virtual_Host equals Prior_Upload_Virtual_Host

OR Backend_Host equals Prior_Upload_Backend_Host

OR Workload_ID equals Prior_Upload_Workload_ID

OR Source_IP equals Prior_Upload_Source_IP

OR Writable_Path_Family equals Prior_Upload_Extension_Family

OR Uploaded_Path equals Prior_Upload_Uploaded_Path

)

THEN mark event as Building_Block_Joomla_Writable_PHP_Web_Access_After_Upload

BUILDING BLOCK 3: Joomla Host Rare Egress or Endpoint Impact After Upload

WHEN events are detected for the same Joomla_Site_ID, same Public_Joomla_Asset, same Backend_Host, same Workload_ID, same Hostname, same Source_IP, same Endpoint_ID, same Process_User, same File_Path, or equivalent normalized Joomla asset lineage

WITHIN ENV_JOOMLA_UPLOAD_TO_IMPACT_WINDOW

AND Building_Block_Joomla_Suspicious_Extension_Upload occurred before Joomla_Impact_Time

AND Joomla_Impact_Time occurs within ENV_JOOMLA_UPLOAD_TO_IMPACT_WINDOW after Suspicious_Extension_Upload_Time

AND Joomla_Site_ID is not null

AND (

Public_Joomla_Asset is contained in reference set ENV_PUBLIC_JOOMLA_ASSETS

OR Hostname is contained in reference set ENV_JOOMLA_WEB_SERVERS

OR Source_IP is contained in reference set ENV_JOOMLA_WEB_SERVER_IPS

OR Endpoint_ID is contained in reference set ENV_JOOMLA_ENDPOINT_IDS

OR Workload_ID is contained in reference set ENV_JOOMLA_WORKLOAD_IDS

)

AND Event_Time is not contained in reference set ENV_APPROVED_JOOMLA_MAINTENANCE_WINDOWS

AND (

(

(

Destination_Domain is not null

OR Destination_IP is not null

)

AND (

Destination_Domain is null

OR Destination_Domain is not contained in reference set ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS

)

AND (

Destination_IP is null

OR Destination_IP is not contained in reference set ENV_APPROVED_JOOMLA_EGRESS_DESTINATIONS

)

AND (

Destination_First_Seen_Status is contained in reference set ENV_NEW_OR_RARE_DESTINATION_STATES

OR Destination_Domain_Age_Days is less than ENV_NEW_DOMAIN_AGE_DAYS

OR Destination_Reputation is contained in reference set ENV_SUSPICIOUS_OR_MALICIOUS_DESTINATION_REPUTATION

OR Destination_ASN is contained in reference set ENV_SUSPICIOUS_ASNS

OR Destination_Geo is not contained in reference map ENV_JOOMLA_EXPECTED_DESTINATION_GEOS for Joomla_Site_ID

OR Destination_Port is contained in reference set ENV_UNUSUAL_JOOMLA_EGRESS_PORTS

OR Proxy_Action is contained in reference set ENV_ALLOWED_PROXY_CONNECTION_ACTIONS

OR Firewall_Action is contained in reference set ENV_ALLOWED_FIREWALL_CONNECTION_ACTIONS

)

)

OR (

(

Process_User is contained in reference set ENV_JOOMLA_WEB_SERVER_SERVICE_USERS

OR Parent_Process_Name is contained in reference set ENV_JOOMLA_WEB_SERVER_PROCESSES

OR Process_Name is contained in reference set ENV_JOOMLA_PHP_RUNTIME_PROCESSES

)

AND (

Process_Name is contained in reference set ENV_SHELL_INTERPRETERS

OR Process_Name is contained in reference set ENV_SCRIPTING_INTERPRETERS

OR Process_Name is contained in reference set ENV_TRANSFER_TOOLS

OR Process_Name is contained in reference set ENV_ARCHIVE_TOOLS

OR Process_Name is contained in reference set ENV_NETWORK_TOOLS

OR Process_Name is contained in reference set ENV_DATABASE_TOOLS

OR Process_Name is contained in reference set ENV_ENCODING_OR_OBFUSCATION_TOOLS

OR Command_Line matches reference set ENV_WEB_SERVER_SUSPICIOUS_COMMAND_PATTERNS

OR Command_Line matches reference set ENV_JOOMLA_CREDENTIAL_ACCESS_COMMAND_PATTERNS

OR Command_Line matches reference set ENV_JOOMLA_DISCOVERY_COMMAND_PATTERNS

)

)

OR (

File_Path is contained in reference set ENV_JOOMLA_WRITABLE_OR_EXTENSION_OWNED_PATHS

AND File_Name is contained in reference set ENV_PHP_LIKE_FILE_PATTERNS

AND File_Event_Action is contained in reference set ENV_FILE_CREATE_MODIFY_RENAME_WRITE_ACTIONS

)

OR (

File_Path is contained in reference set ENV_SENSITIVE_JOOMLA_FILE_PATTERNS

AND File_Event_Action is contained in reference set ENV_FILE_OPEN_READ_MODIFY_COPY_ARCHIVE_ACTIONS

)

OR CMS_State_Change is contained in reference set ENV_SUSPICIOUS_JOOMLA_CMS_STATE_CHANGES

OR FTP_Activity is contained in reference set ENV_SUSPICIOUS_JOOMLA_FTP_ACTIVITY

OR Hosting_Control_Activity is contained in reference set ENV_SUSPICIOUS_HOSTING_CONTROL_ACTIVITY

OR Hosted_Content_Impact is contained in reference set ENV_SUSPICIOUS_HOSTED_CONTENT_IMPACT

)

AND (

Joomla_Site_ID equals Prior_Upload_Joomla_Site_ID

OR Public_Joomla_Asset equals Prior_Upload_Public_Joomla_Asset

OR Backend_Host equals Prior_Upload_Backend_Host

OR Workload_ID equals Prior_Upload_Workload_ID

OR Hostname equals Prior_Upload_Backend_Host

OR Source_IP equals Prior_Upload_Public_Joomla_Asset_IP

OR Endpoint_ID equals Prior_Upload_Endpoint_ID

)

AND NOT (

Source_IP is contained in reference set ENV_APPROVED_JOOMLA_ADMIN_SOURCES

OR Source_IP is contained in reference set ENV_APPROVED_JOOMLA_SCANNER_SOURCES

OR Source_IP is contained in reference set ENV_APPROVED_HOSTING_PROVIDER_SUPPORT_SOURCES

OR Source_IP is contained in reference set ENV_APPROVED_JOOMLA_VALIDATION_SOURCES

OR User_Name is contained in reference set ENV_APPROVED_JOOMLA_DEPLOYMENT_USERS

OR User_Name is contained in reference set ENV_APPROVED_JOOMLA_BACKUP_USERS

OR User_Name is contained in reference set ENV_APPROVED_JOOMLA_MIGRATION_USERS

OR Process_Name is contained in reference set ENV_APPROVED_JOOMLA_PROCESS_BASELINE

OR File_Path is contained in reference set ENV_APPROVED_JOOMLA_FILE_PATHS

OR Command_Line matches reference set ENV_APPROVED_JOOMLA_COMMAND_PATTERNS

OR Event_Time is contained in reference set ENV_APPROVED_JOOMLA_MAINTENANCE_WINDOWS

OR Event_Time is contained in reference set ENV_APPROVED_JOOMLA_VALIDATION_WINDOWS

OR Event_Time is contained in reference set ENV_APPROVED_JOOMLA_CLEANUP_WINDOWS

)

THEN generate offense with context:

Joomla_Site_ID,

Public_Joomla_Asset,

Virtual_Host,

Backend_Host,

Workload_ID,

Source_IP,

Source_Geo,

User_Agent,

HTTP_Method,

Request_Path,

Request_Query,

HTTP_Status_Code,

Request_Size,

Response_Size,

Content_Type,

Extension_Family,

Writable_Path_Family,

Uploaded_Path,

Prior_Upload_Joomla_Site_ID,

Prior_Upload_Public_Joomla_Asset,

Prior_Upload_Source_IP,

Prior_Upload_Extension_Family,

Prior_Upload_Uploaded_Path,

Writable_PHP_Access_Time,

Suspicious_Extension_Upload_Time,

Joomla_Impact_Time,

Hostname,

Endpoint_ID,

Process_User,

Parent_Process_Name,

Process_Name,

Command_Line,

File_Path,

File_Name,

File_Event_Action,

Destination_Domain,

Destination_IP,

Destination_Port,

Destination_Reputation,

Destination_First_Seen_Status,

Destination_Domain_Age_Days,

Destination_ASN,

Destination_Geo,

CMS_State_Change,

FTP_Activity,

Hosting_Control_Activity,

Hosted_Content_Impact,

Building_Block_Joomla_Suspicious_Extension_Upload,

Building_Block_Joomla_Writable_PHP_Web_Access_After_Upload

Sigma

Detection Viability Assessment

Production-deployable where the target SIEM can map Joomla web, endpoint, DNS, proxy, firewall, EDR, Linux audit, file-integrity, CMS state, FTP, hosting-control, and hosted-content telemetry into locally enriched fields. Sigma is appropriate as a portable event-rule template when prior correlation or enrichment identifies Joomla site context, extension upload context, writable PHP access, endpoint impact, rare egress, and approved workflow exceptions. This rule should not be deployed as raw log matching without local enrichment, field mapping, exception handling, and environment-specific baselining.

Rule

Joomla Extension Upload Abuse With PHP Webshell or Host Impact Indicators

Rule Format

Sigma event-rule template requiring local SIEM field mapping, Joomla site enrichment, webroot and writable-path enrichment, extension-route enrichment, approved workflow exceptions, egress baselining, and endpoint-impact enrichment.

Detection Purpose

Detect locally enriched Joomla events indicating suspicious extension upload or import behavior with correlated writable PHP access, web server service-context execution, sensitive Joomla file access, suspicious tooling, rare outbound communication, CMS state change, FTP activity, hosting-control activity, or hosted-content impact.

Detection Logic

Trigger when a locally enriched Joomla event indicates suspicious extension upload or import activity and correlated PHP web access, rare egress, endpoint execution, sensitive-file access, or CMS impact within the configured Joomla upload-to-impact window.

Assign medium severity when suspicious Joomla extension upload or import behavior is enriched without confirmed follow-on execution or impact.

Assign high severity when suspicious Joomla extension upload or import activity is enriched with writable-path PHP access, web server service-context execution, sensitive Joomla file access, transfer-tool use, archive activity, database access, suspicious command execution, or rare egress.

Promote to critical in the downstream SIEM workflow when the enriched event includes confirmed webshell artifact evidence, Joomla administrator or Super User creation, credential-file access, database dump behavior, FTP abuse, hosting-control abuse, hosted-content tampering, phishing or malware hosting, spam infrastructure, or multi-site compromise.

Required Telemetry

·        SIEM-normalized web access telemetry.

·        SIEM-normalized WAF, reverse-proxy, CDN, or load-balancer telemetry where available.

·        SIEM-normalized DNS telemetry.

·        SIEM-normalized proxy telemetry.

·        SIEM-normalized firewall telemetry.

·        SIEM-normalized endpoint or EDR telemetry where available.

·        SIEM-normalized Linux audit or file-integrity telemetry where available.

·        Joomla public asset enrichment.

·        Joomla site-ID enrichment.

·        Joomla extension upload-route enrichment.

·        Joomla writable-path enrichment.

·        Joomla PHP-like artifact enrichment.

·        Joomla sensitive-file enrichment.

·        Web server service-context enrichment.

·        Rare egress enrichment.

·        Approved Joomla administrator source enrichment.

·        Approved scanner source enrichment.

·        Approved hosting-provider support-source enrichment.

·        Approved deployment or validation workflow enrichment.

·        Approved maintenance-window enrichment.

·        Approved process, command, path, and egress enrichment.

Engineering Implementation Instructions

Map all Sigma fields to the target SIEM schema before deployment.

Create local enrichment for Joomla site ID, public Joomla asset, virtual host, backend host, workload ID, source IP, source geo, user agent, HTTP method, request path, request query, HTTP status code, request size, response size, content type, extension family, writable path family, uploaded path, PHP-like artifact path, endpoint ID, process user, parent process name, process name, command line, file path, file name, file event action, destination domain, destination IP, destination port, destination reputation, destination first-seen status, destination domain age, destination ASN, destination geo, CMS state change, FTP activity, hosting-control activity, and hosted-content impact.

Use upstream SIEM correlation, enrichment pipelines, scheduled searches, transform rules, or detection content to populate fields such as joomla.correlation.extension_upload_seen, joomla.correlation.writable_php_access_after_upload, joomla.correlation.endpoint_or_egress_impact_after_upload, and joomla.correlation.upload_to_impact_window_active.

Do not deploy this Sigma rule as a raw URI-only signature. It depends on local enrichment and correlation.

Tune exceptions for approved Joomla administrators, scanners, hosting-provider support, validation sources, deployment workflows, backup workflows, migration workflows, maintenance windows, incident-response cleanup, vulnerability validation, approved process baselines, approved command patterns, approved file paths, and approved egress destinations.

Treat field mapping, enrichment ownership, exception-list ownership, baseline freshness, maintenance-window handling, and SOC routing as required local deployment work.

DRI Assessment

Moderate-to-high resilience where the target SIEM enriches Joomla web, endpoint, file, process, and egress telemetry before Sigma evaluation. Lower resilience where Sigma is deployed only against raw web logs, URI paths are missing, query strings are unavailable, Joomla site enrichment is absent, or endpoint and outbound telemetry are not correlated upstream.

DRI

8.0 / 10

TCR Assessment

Operational confidence is strong when the Sigma rule evaluates enriched correlation fields rather than raw isolated events. Confidence is highest when the SIEM has already correlated suspicious Joomla extension upload behavior to writable PHP access, endpoint execution, sensitive-file access, rare egress, CMS state change, FTP activity, hosting-control activity, or hosted-content impact.

Operational TCR

7.8 / 10

Full-Telemetry TCR

8.8 / 10

Limitations

Sigma is not the best layer for raw multi-stage Joomla upload-to-webshell correlation unless the target SIEM supports local enrichment and correlation fields. Raw URI matching alone may miss variants and may create false positives during legitimate Joomla administration, plugin updates, media uploads, template changes, backup jobs, restore jobs, vulnerability validation, hosting-provider support, malware cleanup, or emergency remediation. This rule requires environment-specific field mapping, enrichment, exception handling, and downstream offense or alert routing.

Detection Query Pattern

Use this as a Sigma event-rule template. Map all fields and local enrichment fields to the target SIEM before deployment.

title: Joomla Extension Upload Abuse With PHP Webshell or Host Impact Indicators

id: 0e0f79c2-5f3e-4d6d-bde7-5f1b9a8e91d4

status: experimental

description: Detects locally enriched Joomla extension upload or import abuse correlated with writable PHP access, endpoint execution, sensitive-file access, rare egress, CMS state change, FTP activity, hosting-control activity, or hosted-content impact.

references:

- Internal CyberDax detection model for Joomla extension upload abuse and PHP webshell execution risk

author: CyberDax

date: 2026-07-07

logsource:

  product: webserver

  service: joomla

detection:

  scope_joomla_public_asset:

    joomla.asset.public: true

  scope_joomla_site_context:

joomla.site.id_present: true

  scope_upload_to_impact_window:

    joomla.correlation.upload_to_impact_window_active: true

  suspicious_extension_upload_seen:

    joomla.correlation.extension_upload_seen: true

  suspicious_extension_upload_route:

    joomla.extension.upload_route_match: true

  suspicious_jce_profile_import:

joomla.extension.family: jce

    joomla.request.option: com_jce

    joomla.request.task: profiles.import

  suspicious_sp_page_builder_upload:

joomla.extension.family: sppagebuilder

    joomla.request.task: asset.uploadCustomIcon

  suspicious_page_builder_ck_upload:

joomla.extension.family: pagebuilderck

    joomla.request.action: browse.ajaxAddPicture

  suspicious_generic_media_or_ajax_upload:

    joomla.extension.upload_behavior:

    - profile_import

    - custom_icon_upload

    - asset_upload

    - image_upload

    - media_upload

    - ajax_upload

  source_new_or_rare:

    source.first_seen.status:

    - new

    - rare

  source_suspicious_network_type:

source.network.type:

    - cloud_hosted

    - residential_proxy

    - vpn_provider

    - scanner_infrastructure

    - unknown_hosting

  source_geo_deviation:

    baseline.joomla.expected_source_geo_match: false

  suspicious_user_agent:

    user_agent.risk:

    - rare

    - automated

    - scanner_like

  suspicious_upload_content_type:

    http.request.mime_type:

    - multipart/form-data

    - application/zip

    - application/octet-stream

  upload_request_size_high:

    joomla.request.upload_size_above_baseline: true

  upload_response_size_high:

    joomla.response.size_above_upload_baseline: true

  upload_response_size_low:

    joomla.response.size_below_upload_baseline: true

  upload_request_timing_suspicious:

    joomla.request.timing_pattern:

    - rapid_retry

    - automation_like

    - low_and_slow_probe

    - failed_then_successful_upload

  upload_status_sequence_abnormal:

    joomla.http.status_sequence:

    - repeated_errors

    - errors_then_success

    - upload_success_after_errors

    - abnormal_redirect_sequence

  writable_php_access_after_upload:

    joomla.correlation.writable_php_access_after_upload: true

  php_like_web_artifact:

    joomla.path.php_like_web_artifact: true

  writable_or_extension_owned_path:

    joomla.path.writable_or_extension_owned: true

  php_access_status:

    http.response.status_code:

    - 200

    - 206

    - 302

    - 403

    - 404

    - 500

  php_access_timing_suspicious:

    joomla.request.timing_pattern:

    - single_probe_then_repeat

    - interactive_webshell_like

    - low_volume_callback_test

  endpoint_or_egress_impact_after_upload:

    joomla.correlation.endpoint_or_egress_impact_after_upload: true

  web_server_service_context:

    joomla.web_server.context: true

  suspicious_web_server_child_process:

process.name:

    - sh

    - bash

    - dash

    - zsh

    - ksh

    - cmd.exe

    - powershell.exe

    - pwsh

    - python

    - python3

    - perl

    - ruby

    - php

    - php-cgi

    - curl

    - wget

    - nc

    - netcat

    - ncat

    - socat

    - tar

    - zip

    - gzip

    - mysqldump

    - mysql

    - sqlite3

    - base64

    - openssl

  suspicious_command_pattern:

    joomla.command.pattern_match:

    - web_server_suspicious_command

    - joomla_credential_access_command

    - joomla_discovery_command

  writable_php_file_activity:

    joomla.file.writable_php_artifact_activity: true

  sensitive_joomla_file_access:

    joomla.file.sensitive_file_access: true

  rare_joomla_egress:

joomla.network.rare_egress: true

  suspicious_destination:

    destination.reputation:

    - unknown

    - suspicious

    - malicious

  destination_new_or_rare:

    destination.first_seen.status:

    - new

    - rare

  destination_domain_new:

    destination.domain.age_category:

    - new

    - very_new

  destination_geo_deviation:

    baseline.joomla.expected_destination_geo_match: false

  unusual_egress_port:

    destination.port.risk: unusual_for_joomla

  cms_state_change:

    joomla.cms.state_change:

    - administrator_created

    - super_user_created

    - template_modified

    - plugin_modified

    - redirect_modified

    - mail_script_modified

    - cron_modified

    - htaccess_modified

  ftp_activity:

    joomla.ftp.activity:

    - suspicious_login

    - unexpected_upload

    - unexpected_download

    - credential_reuse_indicator

  hosting_control_activity:

    hosting.control.activity:

    - unexpected_panel_login

    - file_manager_upload

    - domain_redirect_change

    - mail_setting_change

    - scheduled_task_change

  hosted_content_impact:

    hosted.content.impact:

    - tampering

    - phishing_hosting

    - malware_hosting

    - spam_infrastructure

  same_site_or_asset_context:

    correlation.same_joomla_site_or_asset: true

  same_upload_to_impact_lineage:

    correlation.same_upload_to_impact_lineage: true

  filter_approved_joomla_admin_source:

    exception.approved_joomla_admin_source: true

  filter_approved_joomla_scanner:

    exception.approved_joomla_scanner: true

  filter_approved_hosting_provider_support:

    exception.approved_hosting_provider_support_source: true

  filter_approved_joomla_validation:

    exception.approved_joomla_validation_source: true

  filter_approved_joomla_deployment:

    exception.approved_joomla_deployment_source: true

  filter_approved_joomla_maintenance:

    exception.approved_joomla_maintenance_window: true

  filter_approved_joomla_backup:

    exception.approved_joomla_backup_workflow: true

  filter_approved_joomla_migration:

    exception.approved_joomla_migration_workflow: true

  filter_approved_joomla_cleanup:

    exception.approved_joomla_cleanup_window: true

  filter_approved_joomla_process:

    exception.approved_joomla_process_baseline: true

  filter_approved_joomla_path:

    exception.approved_joomla_file_path: true

  filter_approved_joomla_command:

    exception.approved_joomla_command_pattern: true

  filter_approved_joomla_egress:

    exception.approved_joomla_egress_destination: true

  condition: scope_joomla_public_asset and scope_joomla_site_context and scope_upload_to_impact_window and suspicious_extension_upload_seen and same_site_or_asset_context and same_upload_to_impact_lineage and (1 of suspicious_* or 1 of source_* or 1 of upload_* or writable_php_access_after_upload or endpoint_or_egress_impact_after_upload or web_server_service_context or writable_php_file_activity or sensitive_joomla_file_access or rare_joomla_egress or cms_state_change or ftp_activity or hosting_control_activity or hosted_content_impact) and not 1 of filter_

fields:

- joomla.site.id

- joomla.asset.name

- joomla.asset.public

- joomla.virtual_host

- joomla.backend_host

- joomla.workload.id

- source.ip

- source.geo.country_name

- user_agent.original

- http.request.method

- url.path

- url.query

- http.response.status_code

- http.request.bytes

- http.response.bytes

- http.request.mime_type

- joomla.extension.family

- joomla.path.writable_family

- joomla.uploaded.path

- joomla.correlation.extension_upload_seen

- joomla.correlation.writable_php_access_after_upload

- joomla.correlation.endpoint_or_egress_impact_after_upload

- joomla.correlation.upload_to_impact_window_active

- host.name

- host.id

- process.user.name

- process.parent.name

- process.name

- process.command_line

- file.path

- file.name

- event.action

- destination.domain

- destination.ip

- destination.port

- destination.reputation

- destination.first_seen.status

- destination.domain.age_days

- destination.as.number

- destination.geo.country_name

- joomla.cms.state_change

- joomla.ftp.activity

- hosting.control.activity

- hosted.content.impact

falsepositives:

- Approved Joomla administration, extension update, template update, media upload, or deployment activity

- Approved vulnerability validation, malware cleanup, or emergency remediation workflow

- Approved hosting-provider support activity

- Approved backup, restore, or migration workflow

- Approved scanner activity

- Approved web server maintenance or process baseline activity

- Approved egress to known Joomla business, update, monitoring, CDN, backup, or hosting-provider destinations

level: high

YARA

YARA Coverage Disposition

YARA has zero deployable rules for this EXP report.

YARA is not viable as a primary S25 detection system because the report’s detection model is behavioral, sequence-based, web-telemetry driven, SIEM-correlation based, endpoint-context based, egress-correlation based, and CMS-impact based rather than static-file, malware-signature, or artifact-matching based.

YARA may provide limited supporting value only if a confirmed malicious PHP artifact, webshell body, encoded payload, loader, dropper, script artifact, archive artifact, memory artifact, configuration implant, or reusable malware family artifact is recovered and independently validated.

Final YARA Outcome

No YARA rules survive.

AWS

Detection Viability Assessment

Production-deployable only where Joomla web infrastructure, hosting workflows, cloud workloads, storage, secrets, identity, logging, or administrative activity is hosted in or connected to AWS. AWS is not a primary detection layer for Joomla extension upload abuse itself because the core behavior begins in web application, extension, webroot, endpoint, and egress telemetry. AWS becomes viable when suspicious Joomla extension upload or webshell behavior can be correlated to CloudTrail, GuardDuty, Security Hub, VPC Flow Logs, Route 53 Resolver logs, S3 access logs, EC2 or ECS activity, Secrets Manager access, KMS activity, IAM activity, CloudWatch logging changes, or hosting-control activity.

Rule

AWS Cloud Activity After Joomla Extension Upload Abuse or Webshell Execution

Rule Format

AWS correlation pseudologic requiring CloudTrail, GuardDuty, Security Hub, VPC Flow Logs, Route 53 Resolver logs, S3 access logs where applicable, workload identity mapping, Joomla asset enrichment, approved-role lookups, automation allowlists, source baselines, resource baselines, and time-window mapping.

Detection Purpose

Detect suspicious AWS activity occurring after Joomla extension upload abuse, writable PHP access, endpoint-confirmed webshell execution, rare egress, credential-file access, CMS state change, FTP activity, hosting-control activity, or hosted-content impact involving AWS-hosted Joomla assets or AWS-connected hosting workflows.

Detection Logic

Trigger when suspicious AWS activity occurs within a defined correlation window after locally enriched Joomla extension upload abuse or webshell execution context.

Assign medium severity when AWS activity follows suspicious Joomla upload or webshell context but remains limited to low-risk enumeration, benign-looking resource access, or unusual source behavior requiring review.

Assign high severity when AWS activity includes IAM changes, access-key activity, Secrets Manager access, KMS access, S3 enumeration, S3 object access, EC2 or ECS instance changes, security group changes, CloudWatch logging changes, CloudTrail changes, Lambda changes, container task changes, or suspicious GuardDuty or Security Hub findings.

Promote to critical when AWS activity includes privilege escalation, new access key creation, disabling logging or security controls, sensitive S3 access, secrets retrieval, KMS decrypt activity, cross-account role assumption, security group exposure, snapshot or image export, destructive resource activity, or confirmed use of Joomla-derived credentials or webshell-originated AWS access.

Required Telemetry

·        AWS CloudTrail management events.

·        AWS CloudTrail data events where applicable.

·        AWS IAM Identity Center events where applicable.

·        AWS GuardDuty findings.

·        AWS Security Hub findings.

·        AWS Config events where applicable.

·        AWS Organizations events where applicable.

·        AWS VPC Flow Logs where applicable.

·        AWS Route 53 Resolver query logs where applicable.

·        AWS S3 access logs or CloudTrail S3 data events where applicable.

·        AWS Secrets Manager events.

·        AWS KMS events.

·        AWS EC2 events.

·        AWS ECS or EKS events where applicable.

·        AWS Lambda events where applicable.

·        AWS CloudWatch events.

·        AWS CloudTrail configuration events.

·        Joomla-to-AWS workload mapping.

·        Joomla public asset to AWS account mapping.

·        Joomla site to EC2, ECS, EKS, Lambda, ALB, S3, IAM role, or workload identity mapping.

·        Locally enriched Joomla upload or webshell context.

·        Approved AWS automation identity lookup.

·        Approved CI/CD or IaC role lookup.

·        Approved break-glass identity lookup.

·        Approved security-tooling identity lookup.

·        Approved incident-response identity lookup.

·        Expected AWS role, region, account, source, and user-agent baselines.

·        Sensitive AWS resource lookup.

Engineering Implementation Instructions

Map AWS account ID, user identity ARN, role ARN, assumed role ARN, IAM Identity Center user, federated user principal, access key ID, source IP, user agent, AWS region, event name, event source, resource ID, resource ARN, request parameters, response elements, error code, GuardDuty finding type, Security Hub finding type, VPC source and destination fields, Route 53 query fields, S3 bucket and object fields, Secrets Manager secret ID, KMS key ID, EC2 instance ID, ECS task or service ID, EKS cluster identity, Lambda function name, CloudTrail name, CloudWatch log group, and event timestamp.

Create or ingest a normalized joomla_cloud_context view from Joomla web telemetry, WAF logs, reverse-proxy logs, CDN logs, endpoint telemetry, EDR telemetry, DNS logs, proxy logs, firewall logs, CMS state telemetry, FTP telemetry, hosting-control telemetry, and hosted-content impact telemetry.

Require the joomla_cloud_context view to include Joomla site ID, public asset, backend host, workload ID, AWS account ID, AWS region, instance ID, container ID, role ARN, assumed role ARN, source IP, destination IP, public asset IP, S3 bucket, secret ID, KMS key ID, webshell execution time, suspicious upload time, rare egress time, credential-file access time, and impact context where available.

Map Joomla-hosted infrastructure to AWS accounts, regions, VPCs, ALBs, EC2 instances, ECS services, EKS clusters, Lambda functions, S3 buckets, IAM roles, instance profiles, secrets, KMS keys, and CloudWatch log groups.

Require AWS account lineage plus at least one stronger workload, identity, source, resource, host, S3, Secrets Manager, or KMS linkage before correlating AWS activity to Joomla compromise context. AWS region should support anomaly assessment and triage, not act as a standalone correlation key.

Tune approved automation, CI/CD, IaC, break-glass, security-tooling, incident-response, backup, monitoring, hosting-provider, and maintenance workflows.

Treat CloudTrail data-event enablement, S3 data-event coverage, Secrets Manager logging, KMS logging, GuardDuty coverage, Security Hub ingestion, workload-to-account mapping, source-IP preservation, role-to-host mapping, and SOC routing as required local deployment work.

DRI Assessment

Moderate-to-high resilience where Joomla infrastructure is AWS-hosted or AWS-connected and where AWS identity, resource, source, and workload telemetry can be tied back to Joomla site context through account lineage and stronger workload, identity, source, resource, host, S3, Secrets Manager, or KMS linkage. Lower resilience where Joomla is not hosted in AWS, CloudTrail data events are disabled, workload identity mapping is incomplete, source IP is masked by hosting infrastructure, or AWS activity cannot be correlated to the affected Joomla site or host.

DRI

8.2 / 10

TCR Assessment

Operational confidence is strongest when suspicious AWS activity follows confirmed Joomla upload abuse, writable PHP access, webshell execution, credential-file access, rare egress, or CMS impact involving AWS-hosted assets. Confidence is lower when AWS activity only shares broad account, source, or timing context without Joomla workload lineage.

Operational TCR

7.9 / 10

Full-Telemetry TCR

8.9 / 10

Limitations

AWS telemetry does not directly detect Joomla extension upload abuse unless Joomla infrastructure, hosting workflows, or attacker follow-on activity touch AWS services. This rule is not applicable to Joomla sites hosted entirely outside AWS without AWS-connected identity, storage, secrets, logging, compute, or hosting-control workflows. CloudTrail data events, S3 object logging, VPC Flow Logs, Route 53 Resolver logs, GuardDuty, Security Hub, and workload mapping must be enabled where relevant. AWS region alone must not be used as a correlation key because it can over-correlate unrelated activity in the same region. Legitimate automation, CI/CD, IaC, break-glass access, security tooling, backup workflows, hosting-provider operations, and incident-response activity can resemble suspicious AWS activity and must be explicitly allowlisted.

Detection Query Pattern

Use this pattern as implementation-ready AWS correlation pseudologic and map all CloudTrail fields, GuardDuty fields, Security Hub fields, VPC Flow Log fields, Route 53 Resolver fields, S3 data-event fields, Joomla cloud-context fields, approved-role lookups, automation allowlists, source baselines, resource baselines, and time windows to the target AWS analytics or SIEM environment before deployment.

joomla_cloud_context represents a normalized correlation view derived from Joomla web logs, WAF logs, reverse-proxy logs, CDN logs, load-balancer logs, endpoint logs, EDR logs, Linux audit logs, file-integrity logs, DNS logs, proxy logs, firewall logs, CMS state telemetry, FTP telemetry, hosting-control telemetry, hosted-content impact telemetry, AWS workload inventory, AWS account mapping, AWS role mapping, and source-enrichment context. Local teams must create, map, or enrich this view before deploying the AWS correlation pattern.

FROM aws_cloudtrail_management_events,

aws_cloudtrail_data_events,

aws_iam_identity_center_events,

aws_guardduty_findings,

aws_securityhub_findings,

aws_config_events,

aws_organizations_events,

aws_vpc_flow_logs,

aws_route53_resolver_logs,

aws_s3_access_events,

joomla_cloud_context

WHERE aws.account_id IS NOT NULL

AND joomla_cloud_context.event_time IS NOT NULL

AND aws.event_time BETWEEN joomla_cloud_context.event_time AND joomla_cloud_context.event_time + ENV_JOOMLA_TO_AWS_IMPACT_WINDOW

AND joomla_cloud_context.joomla_site_id IS NOT NULL

AND joomla_cloud_context.aws_account_id = aws.account_id

AND (

joomla_cloud_context.instance_id = aws.resource_id

OR joomla_cloud_context.instance_id = aws.ec2_instance_id

OR joomla_cloud_context.container_id = aws.container_id

OR joomla_cloud_context.workload_id = aws.workload_id

OR joomla_cloud_context.role_arn = aws.role_arn

OR joomla_cloud_context.assumed_role_arn = aws.assumed_role_arn

OR joomla_cloud_context.source_ip = aws.source_ip

OR joomla_cloud_context.destination_ip = aws.source_ip

OR joomla_cloud_context.public_asset_ip = aws.source_ip

OR joomla_cloud_context.backend_host = aws.host_name

OR joomla_cloud_context.s3_bucket = aws.s3_bucket

OR joomla_cloud_context.secret_id = aws.secret_id

OR joomla_cloud_context.kms_key_id = aws.kms_key_id

)

AND joomla_cloud_context.type IN (

"suspicious_joomla_extension_upload",

"joomla_writable_php_access_after_upload",

"joomla_endpoint_webshell_execution",

"joomla_sensitive_file_access",

"joomla_credential_file_access",

"joomla_database_access_or_dump",

"joomla_rare_egress_after_upload",

"joomla_admin_or_super_user_creation",

"joomla_cms_state_change",

"joomla_ftp_abuse",

"joomla_hosting_control_abuse",

"joomla_hosted_content_tampering",

"joomla_phishing_or_malware_hosting",

"joomla_spam_infrastructure"

)

AND (

aws.event_name IN ENV_SUSPICIOUS_AWS_FEDERATED_ACCESS_EVENTS

OR aws.event_name IN ENV_SUSPICIOUS_AWS_ADMIN_EVENTS

OR aws.event_name IN ENV_AWS_IAM_PRIVILEGE_ESCALATION_EVENTS

OR aws.event_name IN ENV_AWS_ACCESS_KEY_EVENTS

OR aws.event_name IN ENV_AWS_SECURITY_CONTROL_MODIFICATION_EVENTS

OR aws.event_name IN ENV_AWS_LOGGING_MODIFICATION_EVENTS

OR aws.event_name IN ENV_AWS_SENSITIVE_DATA_ACCESS_EVENTS

OR aws.event_name IN ENV_AWS_S3_ENUMERATION_OR_EXFILTRATION_EVENTS

OR aws.event_name IN ENV_AWS_SECRETS_OR_KMS_ACCESS_EVENTS

OR aws.event_name IN ENV_AWS_COMPUTE_MODIFICATION_EVENTS

OR aws.event_name IN ENV_AWS_NETWORK_EXPOSURE_EVENTS

OR aws.event_name IN ENV_AWS_SNAPSHOT_OR_IMAGE_EXPORT_EVENTS

OR aws.event_name IN ENV_AWS_ORGANIZATIONS_ADMIN_EVENTS

OR aws.event_name IN ENV_AWS_IAM_IDENTITY_CENTER_ADMIN_EVENTS

OR aws.guardduty_finding_type IN ENV_RELEVANT_GUARDDUTY_FINDINGS

OR aws.securityhub_finding_type IN ENV_RELEVANT_SECURITYHUB_FINDINGS

OR aws.vpc_flow_anomaly_type IN ENV_RELEVANT_VPC_FLOW_ANOMALIES

OR aws.route53_query_risk IN ENV_RELEVANT_ROUTE53_QUERY_RISKS

)

AND (

aws.source_ip NOT IN ENV_APPROVED_AWS_ADMIN_SOURCE_IPS

OR aws.user_agent NOT IN ENV_EXPECTED_AWS_USER_AGENTS_BY_ROLE

OR aws.aws_region NOT IN ENV_EXPECTED_AWS_REGIONS_BY_ROLE

OR aws.role_arn NOT IN ENV_EXPECTED_AWS_ROLES_BY_USER

OR aws.account_id NOT IN ENV_EXPECTED_AWS_ACCOUNTS_BY_USER

OR aws.access_key_id IS NEW_FOR aws.normalized_user_id WITHIN ENV_ACCESS_KEY_NOVELTY_WINDOW

OR aws.event_name IN ENV_HIGH_RISK_AWS_EVENTS_REQUIRING_REVIEW

OR aws.resource_id IN ENV_SENSITIVE_AWS_RESOURCES

OR aws.resource_arn IN ENV_SENSITIVE_AWS_RESOURCE_ARNS

OR aws.s3_bucket IN ENV_SENSITIVE_AWS_S3_BUCKETS

OR aws.secret_id IN ENV_SENSITIVE_AWS_SECRETS

OR aws.kms_key_id IN ENV_SENSITIVE_AWS_KMS_KEYS

)

AND NOT (

aws.user_identity_arn IN ENV_APPROVED_AWS_AUTOMATION_IDENTITIES

AND aws.source_ip IN ENV_APPROVED_AWS_AUTOMATION_SOURCE_IPS

AND aws.event_name IN ENV_APPROVED_AWS_AUTOMATION_EVENTS

AND aws.resource_id NOT IN ENV_SENSITIVE_AWS_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

aws.role_arn IN ENV_APPROVED_CICD_OR_IAC_ROLES

AND aws.source_ip IN ENV_APPROVED_CICD_OR_IAC_SOURCE_IPS

AND aws.event_name IN ENV_APPROVED_CICD_OR_IAC_EVENTS

AND aws.resource_id NOT IN ENV_SENSITIVE_AWS_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

aws.user_identity_arn IN ENV_APPROVED_BREAK_GLASS_IDENTITIES

AND aws.source_ip IN ENV_APPROVED_BREAK_GLASS_SOURCE_IPS

AND aws.event_name IN ENV_APPROVED_BREAK_GLASS_EVENTS

AND aws.resource_id NOT IN ENV_SENSITIVE_AWS_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

aws.user_identity_arn IN ENV_APPROVED_SECURITY_TOOLING_IDENTITIES

AND aws.source_ip IN ENV_APPROVED_SECURITY_TOOLING_SOURCE_IPS

AND aws.event_name IN ENV_APPROVED_SECURITY_TOOLING_EVENTS

AND aws.resource_id NOT IN ENV_SENSITIVE_AWS_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

aws.user_identity_arn IN ENV_APPROVED_INCIDENT_RESPONSE_IDENTITIES

AND aws.source_ip IN ENV_APPROVED_INCIDENT_RESPONSE_SOURCE_IPS

AND aws.event_name IN ENV_APPROVED_INCIDENT_RESPONSE_EVENTS

AND aws.resource_id NOT IN ENV_SENSITIVE_AWS_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

aws.role_arn IN ENV_APPROVED_HOSTING_PROVIDER_OR_PLATFORM_ROLES

AND aws.source_ip IN ENV_APPROVED_HOSTING_PROVIDER_OR_PLATFORM_SOURCE_IPS

AND aws.event_name IN ENV_APPROVED_HOSTING_PROVIDER_OR_PLATFORM_EVENTS

AND aws.resource_id NOT IN ENV_SENSITIVE_AWS_RESOURCES_REQUIRING_REVIEW

)

AND aws.user_identity_arn NOT IN ENV_ACTIVE_INVESTIGATION_SUPPRESSIONS

GROUP BY aws.account_id,

aws.normalized_user_id,

aws.user_identity_arn,

aws.role_arn,

aws.source_ip,

aws.user_agent,

aws.aws_region,

aws.event_name,

aws.resource_id,

joomla_cloud_context.joomla_site_id,

joomla_cloud_context.type

EMIT alert WHEN

count_distinct(aws.event_name) >= ENV_MIN_DISTINCT_AWS_RISK_EVENTS

OR aws.event_name IN ENV_HIGH_RISK_AWS_EVENTS_REQUIRING_REVIEW

OR aws.access_key_id IS NEW_FOR aws.normalized_user_id WITHIN ENV_ACCESS_KEY_NOVELTY_WINDOW

OR aws.guardduty_finding_type IN ENV_RELEVANT_GUARDDUTY_FINDINGS

OR aws.securityhub_finding_type IN ENV_RELEVANT_SECURITYHUB_FINDINGS

OR aws.vpc_flow_anomaly_type IN ENV_RELEVANT_VPC_FLOW_ANOMALIES

OR aws.route53_query_risk IN ENV_RELEVANT_ROUTE53_QUERY_RISKS

Azure

Detection Viability Assessment

Production-deployable only where Joomla web infrastructure, hosting workflows, cloud workloads, storage, secrets, identity, logging, or administrative activity is hosted in or connected to Azure. Azure is not a primary detection layer for Joomla extension upload abuse itself because the core behavior begins in web application, extension, webroot, endpoint, and egress telemetry. Azure becomes viable when suspicious Joomla extension upload or webshell behavior can be correlated to Azure Activity logs, Entra ID sign-in logs, Entra ID audit logs, Defender for Cloud alerts, Sentinel incidents, Key Vault access, Storage access, network security changes, diagnostic-setting changes, role assignments, service-principal activity, managed-identity activity, App Service activity, VM activity, container activity, or hosting-control activity.

Rule

Azure Control-Plane Activity After Joomla Extension Upload Abuse or Webshell Execution

Rule Format

Azure control-plane and resource-access correlation pseudologic requiring Azure Activity logs, Entra ID logs, Defender for Cloud alerts, Sentinel incidents, Key Vault logs, Storage logs, service-principal activity, managed-identity activity, workload identity mapping, Joomla asset enrichment, approved-workflow lookups, automation allowlists, source baselines, role baselines, resource baselines, subscription baselines, and time-window mapping.

Detection Purpose

Detect suspicious Azure control-plane, identity, storage, secrets, network, logging, or resource-access activity occurring after Joomla extension upload abuse, writable PHP access, endpoint-confirmed webshell execution, rare egress, credential-file access, CMS state change, FTP activity, hosting-control activity, or hosted-content impact involving Azure-hosted Joomla assets or Azure-connected hosting workflows.

Detection Logic

Trigger when suspicious Azure control-plane or resource-access activity occurs within a defined correlation window after locally enriched Joomla extension upload abuse or webshell execution context.

Assign medium severity when Azure activity follows suspicious Joomla upload or webshell context but remains limited to low-risk enumeration, benign-looking resource access, unusual source behavior, or anomalous subscription context requiring review.

Assign high severity when Azure activity includes role assignment changes, service-principal changes, managed-identity activity, Key Vault access, Storage enumeration or object access, VM changes, App Service changes, container workload changes, network security changes, diagnostic-setting changes, policy changes, logging changes, Defender for Cloud alerts, or Sentinel incidents.

Promote to critical when Azure activity includes privilege escalation, new role assignment, service-principal credential addition, managed-identity abuse, Key Vault secret retrieval, storage exfiltration, diagnostic logging disablement, security-control modification, public exposure of resources, destructive resource activity, or confirmed use of Joomla-derived credentials or webshell-originated Azure access.

Required Telemetry

·        Azure Activity logs.

·        Entra ID sign-in logs.

·        Entra ID audit logs.

·        Azure Resource Manager activity.

·        Azure role assignment events.

·        Azure service-principal activity.

·        Azure managed-identity activity.

·        Azure Key Vault logs.

·        Azure Storage logs.

·        Defender for Cloud alerts.

·        Sentinel incidents where applicable.

·        Azure Policy events where applicable.

·        Azure diagnostic-setting events.

·        Azure network security group events.

·        Azure Firewall or NSG flow logs where applicable.

·        Azure App Service logs where applicable.

·        Azure VM activity where applicable.

·        Azure container workload activity where applicable.

·        Joomla-to-Azure workload mapping.

·        Joomla public asset to Azure tenant/subscription/resource mapping.

·        Joomla site to VM, App Service, container app, AKS, storage account, Key Vault, managed identity, service principal, or workload identity mapping.

·        Locally enriched Joomla upload or webshell context.

·        Approved Azure automation identity lookup.

·        Approved CI/CD or IaC identity lookup.

·        Approved break-glass identity lookup.

·        Approved security-tooling identity lookup.

·        Approved incident-response identity lookup.

·        Expected tenant, subscription, role, source, application, service-principal, managed-identity, and user-agent baselines.

·        Sensitive Azure resource lookup.

Engineering Implementation Instructions

Map tenant ID, subscription ID, normalized identity ID, user principal name, Entra user ID, application ID, service principal ID, managed identity ID, source IP, user agent, event name, operation name, resource ID, resource group, resource provider, resource type, role definition ID, role assignment ID, Key Vault name, secret name, key name, storage account name, container name, blob name, VM name, App Service name, container workload identity, diagnostic setting name, policy assignment ID, Defender for Cloud alert type, Sentinel incident type, correlation ID, request parameters, response status, and event timestamp.

Create or ingest a normalized joomla_azure_context view from Joomla web telemetry, WAF logs, reverse-proxy logs, CDN logs, load-balancer logs, endpoint telemetry, EDR telemetry, DNS logs, proxy logs, firewall logs, CMS state telemetry, FTP telemetry, hosting-control telemetry, hosted-content impact telemetry, Azure workload inventory, Azure tenant and subscription mapping, Azure identity mapping, and source-enrichment context.

Require the joomla_azure_context view to include Joomla site ID, public asset, backend host, workload ID, Azure tenant ID, subscription ID, resource group, resource ID, VM ID, App Service ID, container workload ID, application ID, service principal ID, managed identity ID, source IP, destination IP, public asset IP, storage account name, Key Vault name, webshell execution time, suspicious upload time, rare egress time, credential-file access time, and impact context where available.

Map Joomla-hosted infrastructure to Azure tenants, subscriptions, resource groups, VNets, NSGs, public IPs, load balancers, VMs, App Services, Container Apps, AKS clusters, Storage accounts, Key Vaults, managed identities, service principals, role assignments, diagnostic settings, and Sentinel or Defender for Cloud coverage.

Require Azure tenant and subscription lineage plus at least one stronger workload, identity, source, resource, host, Storage, Key Vault, service-principal, managed-identity, application, or correlation-ID linkage before correlating Azure activity to Joomla compromise context. Tenant, subscription, region, and resource group should support anomaly assessment, grouping, and triage, not act as standalone correlation keys.

Tune approved automation, CI/CD, IaC, break-glass, security-tooling, incident-response, backup, monitoring, hosting-provider, platform, and maintenance workflows.

Treat Entra ID log ingestion, Azure Activity retention, Key Vault diagnostic logging, Storage logging, Defender for Cloud coverage, Sentinel ingestion, workload-to-subscription mapping, source-IP preservation, identity-to-host mapping, diagnostic-setting visibility, and SOC routing as required local deployment work.

DRI Assessment

Moderate-to-high resilience where Joomla infrastructure is Azure-hosted or Azure-connected and where Azure identity, resource, source, and workload telemetry can be tied back to Joomla site context through tenant and subscription lineage plus stronger workload, identity, source, resource, host, Storage, Key Vault, service-principal, managed-identity, application, or correlation-ID linkage. Lower resilience where Joomla is not hosted in Azure, resource logs are disabled, Key Vault or Storage logging is incomplete, workload identity mapping is incomplete, source IP is masked by hosting infrastructure, or Azure activity cannot be correlated to the affected Joomla site or host.

DRI

8.2 / 10

TCR Assessment

Operational confidence is strongest when suspicious Azure activity follows confirmed Joomla upload abuse, writable PHP access, webshell execution, credential-file access, rare egress, or CMS impact involving Azure-hosted assets. Confidence is lower when Azure activity only shares broad tenant, subscription, resource-group, source, or timing context without Joomla workload lineage.

Operational TCR

7.9 / 10

Full-Telemetry TCR

8.9 / 10

Limitations

Azure telemetry does not directly detect Joomla extension upload abuse unless Joomla infrastructure, hosting workflows, or attacker follow-on activity touch Azure services. This rule is not applicable to Joomla sites hosted entirely outside Azure without Azure-connected identity, storage, secrets, logging, compute, or hosting-control workflows. Azure Activity logs, Entra ID logs, Key Vault diagnostics, Storage logs, Defender for Cloud, Sentinel, resource diagnostics, and workload mapping must be enabled where relevant. Tenant, subscription, region, or resource group alone must not be used as correlation keys because they can over-correlate unrelated activity in the same cloud environment. Legitimate automation, CI/CD, IaC, break-glass access, security tooling, backup workflows, hosting-provider operations, platform operations, and incident-response activity can resemble suspicious Azure activity and must be explicitly allowlisted.

Detection Query Pattern

Use this pattern as implementation-ready Azure control-plane and resource-access correlation pseudologic and map all Azure Activity fields, Entra ID fields, service-principal fields, managed-identity fields, resource fields, Key Vault fields, Storage fields, Defender for Cloud fields, Sentinel fields, Joomla Azure-context fields, approved-workflow lookups, automation allowlists, source baselines, role baselines, resource baselines, subscription baselines, and time windows to the target Sentinel, SIEM, data-lake, or analytics environment before deployment.

joomla_azure_context represents a normalized correlation view derived from Joomla web logs, WAF logs, reverse-proxy logs, CDN logs, load-balancer logs, endpoint logs, EDR logs, Linux audit logs, file-integrity logs, DNS logs, proxy logs, firewall logs, CMS state telemetry, FTP telemetry, hosting-control telemetry, hosted-content impact telemetry, Azure workload inventory, Azure tenant mapping, Azure subscription mapping, Azure resource mapping, Azure identity mapping, and source-enrichment context.

azure_control_plane_activity represents a normalized Azure control-plane and resource-access view derived from Azure Activity logs, Entra ID sign-in logs, Entra ID audit logs, Azure Resource Manager activity, Azure role assignment events, Key Vault logs, Storage logs, Defender for Cloud alerts, Sentinel incidents, Azure Policy events, diagnostic-setting events, service-principal activity, managed-identity activity, App Service activity, VM activity, container workload activity, identity context, network context, proxy context, endpoint context, and source-enrichment context.

Local teams must create, map, or enrich both views before deploying the Azure control-plane correlation pattern.

FROM azure_control_plane_activity,

joomla_azure_context

WHERE azure_control_plane_activity.normalized_identity_id IS NOT NULL

AND joomla_azure_context.event_time IS NOT NULL

AND azure_control_plane_activity.event_time BETWEEN joomla_azure_context.event_time AND joomla_azure_context.event_time + ENV_JOOMLA_TO_AZURE_CONTROL_PLANE_WINDOW

AND joomla_azure_context.joomla_site_id IS NOT NULL

AND joomla_azure_context.tenant_id = azure_control_plane_activity.tenant_id

AND joomla_azure_context.subscription_id = azure_control_plane_activity.subscription_id

AND (

joomla_azure_context.resource_id = azure_control_plane_activity.resource_id

OR joomla_azure_context.vm_id = azure_control_plane_activity.vm_id

OR joomla_azure_context.app_service_id = azure_control_plane_activity.app_service_id

OR joomla_azure_context.container_workload_id = azure_control_plane_activity.container_workload_id

OR joomla_azure_context.application_id = azure_control_plane_activity.application_id

OR joomla_azure_context.service_principal_id = azure_control_plane_activity.service_principal_id

OR joomla_azure_context.managed_identity_id = azure_control_plane_activity.managed_identity_id

OR joomla_azure_context.source_ip = azure_control_plane_activity.source_ip

OR joomla_azure_context.destination_ip = azure_control_plane_activity.source_ip

OR joomla_azure_context.public_asset_ip = azure_control_plane_activity.source_ip

OR joomla_azure_context.backend_host = azure_control_plane_activity.host_name

OR joomla_azure_context.storage_account_name = azure_control_plane_activity.storage_account_name

OR joomla_azure_context.key_vault_name = azure_control_plane_activity.key_vault_name

OR joomla_azure_context.correlation_id = azure_control_plane_activity.correlation_id

)

AND joomla_azure_context.type IN (

"suspicious_joomla_extension_upload",

"joomla_writable_php_access_after_upload",

"joomla_endpoint_webshell_execution",

"joomla_sensitive_file_access",

"joomla_credential_file_access",

"joomla_database_access_or_dump",

"joomla_rare_egress_after_upload",

"joomla_admin_or_super_user_creation",

"joomla_cms_state_change",

"joomla_ftp_abuse",

"joomla_hosting_control_abuse",

"joomla_hosted_content_tampering",

"joomla_phishing_or_malware_hosting",

"joomla_spam_infrastructure"

)

AND (

azure_control_plane_activity.event_name IN ENV_SUSPICIOUS_AZURE_FEDERATED_ACCESS_EVENTS

OR azure_control_plane_activity.event_name IN ENV_SUSPICIOUS_AZURE_ADMIN_EVENTS

OR azure_control_plane_activity.event_name IN ENV_AZURE_ROLE_ASSIGNMENT_OR_PRIVILEGE_EVENTS

OR azure_control_plane_activity.event_name IN ENV_AZURE_SERVICE_PRINCIPAL_OR_APP_EVENTS

OR azure_control_plane_activity.event_name IN ENV_AZURE_MANAGED_IDENTITY_EVENTS

OR azure_control_plane_activity.event_name IN ENV_AZURE_SECURITY_CONTROL_MODIFICATION_EVENTS

OR azure_control_plane_activity.event_name IN ENV_AZURE_LOGGING_OR_DIAGNOSTIC_MODIFICATION_EVENTS

OR azure_control_plane_activity.event_name IN ENV_AZURE_POLICY_MODIFICATION_EVENTS

OR azure_control_plane_activity.event_name IN ENV_AZURE_NETWORK_SECURITY_MODIFICATION_EVENTS

OR azure_control_plane_activity.event_name IN ENV_AZURE_KEY_VAULT_ACCESS_EVENTS

OR azure_control_plane_activity.event_name IN ENV_AZURE_STORAGE_ENUMERATION_OR_ACCESS_EVENTS

OR azure_control_plane_activity.event_name IN ENV_AZURE_SENSITIVE_RESOURCE_ACCESS_EVENTS

OR azure_control_plane_activity.event_name IN ENV_AZURE_COMPUTE_MODIFICATION_EVENTS

OR azure_control_plane_activity.event_name IN ENV_AZURE_APP_SERVICE_MODIFICATION_EVENTS

OR azure_control_plane_activity.event_name IN ENV_AZURE_CONTAINER_WORKLOAD_EVENTS

OR azure_control_plane_activity.defender_for_cloud_alert_type IN ENV_RELEVANT_DEFENDER_FOR_CLOUD_ALERTS

OR azure_control_plane_activity.sentinel_incident_type IN ENV_RELEVANT_SENTINEL_INCIDENT_TYPES

)

AND (

azure_control_plane_activity.source_ip NOT IN ENV_APPROVED_AZURE_ADMIN_SOURCE_IPS

OR azure_control_plane_activity.user_agent NOT IN ENV_EXPECTED_AZURE_USER_AGENTS_BY_ROLE

OR azure_control_plane_activity.tenant_id NOT IN ENV_EXPECTED_TENANTS_BY_USER_OR_APP

OR azure_control_plane_activity.subscription_id NOT IN ENV_EXPECTED_SUBSCRIPTIONS_BY_USER_OR_APP

OR azure_control_plane_activity.role_definition_id NOT IN ENV_EXPECTED_AZURE_ROLES_BY_IDENTITY

OR azure_control_plane_activity.application_id NOT IN ENV_EXPECTED_AZURE_APPS_BY_IDENTITY

OR azure_control_plane_activity.service_principal_id NOT IN ENV_EXPECTED_SERVICE_PRINCIPALS_BY_IDENTITY

OR azure_control_plane_activity.managed_identity_id IS NEW_FOR azure_control_plane_activity.normalized_identity_id WITHIN ENV_AZURE_MANAGED_IDENTITY_NOVELTY_WINDOW

OR azure_control_plane_activity.event_name IN ENV_HIGH_RISK_AZURE_EVENTS_REQUIRING_REVIEW

OR azure_control_plane_activity.resource_id IN ENV_SENSITIVE_AZURE_RESOURCES

OR azure_control_plane_activity.resource_group IN ENV_SENSITIVE_AZURE_RESOURCE_GROUPS

OR azure_control_plane_activity.key_vault_name IN ENV_SENSITIVE_KEY_VAULTS

OR azure_control_plane_activity.storage_account_name IN ENV_SENSITIVE_STORAGE_ACCOUNTS

)

AND NOT (

azure_control_plane_activity.normalized_identity_id IN ENV_APPROVED_AZURE_AUTOMATION_IDENTITIES

AND azure_control_plane_activity.source_ip IN ENV_APPROVED_AZURE_AUTOMATION_SOURCE_IPS

AND azure_control_plane_activity.event_name IN ENV_APPROVED_AZURE_AUTOMATION_EVENTS

AND azure_control_plane_activity.resource_id NOT IN ENV_SENSITIVE_AZURE_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

azure_control_plane_activity.service_principal_id IN ENV_APPROVED_CICD_OR_IAC_SERVICE_PRINCIPALS

AND azure_control_plane_activity.source_ip IN ENV_APPROVED_CICD_OR_IAC_SOURCE_IPS

AND azure_control_plane_activity.event_name IN ENV_APPROVED_CICD_OR_IAC_AZURE_EVENTS

AND azure_control_plane_activity.resource_id NOT IN ENV_SENSITIVE_AZURE_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

azure_control_plane_activity.normalized_identity_id IN ENV_APPROVED_BREAK_GLASS_IDENTITIES

AND azure_control_plane_activity.source_ip IN ENV_APPROVED_BREAK_GLASS_SOURCE_IPS

AND azure_control_plane_activity.event_name IN ENV_APPROVED_BREAK_GLASS_AZURE_EVENTS

AND azure_control_plane_activity.resource_id NOT IN ENV_SENSITIVE_AZURE_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

azure_control_plane_activity.normalized_identity_id IN ENV_APPROVED_SECURITY_TOOLING_IDENTITIES

AND azure_control_plane_activity.source_ip IN ENV_APPROVED_SECURITY_TOOLING_SOURCE_IPS

AND azure_control_plane_activity.event_name IN ENV_APPROVED_SECURITY_TOOLING_AZURE_EVENTS

AND azure_control_plane_activity.resource_id NOT IN ENV_SENSITIVE_AZURE_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

azure_control_plane_activity.normalized_identity_id IN ENV_APPROVED_INCIDENT_RESPONSE_IDENTITIES

AND azure_control_plane_activity.source_ip IN ENV_APPROVED_INCIDENT_RESPONSE_SOURCE_IPS

AND azure_control_plane_activity.event_name IN ENV_APPROVED_INCIDENT_RESPONSE_AZURE_EVENTS

AND azure_control_plane_activity.resource_id NOT IN ENV_SENSITIVE_AZURE_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

azure_control_plane_activity.normalized_identity_id IN ENV_APPROVED_HOSTING_PROVIDER_OR_PLATFORM_IDENTITIES

AND azure_control_plane_activity.source_ip IN ENV_APPROVED_HOSTING_PROVIDER_OR_PLATFORM_SOURCE_IPS

AND azure_control_plane_activity.event_name IN ENV_APPROVED_HOSTING_PROVIDER_OR_PLATFORM_AZURE_EVENTS

AND azure_control_plane_activity.resource_id NOT IN ENV_SENSITIVE_AZURE_RESOURCES_REQUIRING_REVIEW

)

AND azure_control_plane_activity.normalized_identity_id NOT IN ENV_ACTIVE_INVESTIGATION_SUPPRESSIONS

GROUP BY azure_control_plane_activity.tenant_id,

azure_control_plane_activity.subscription_id,

azure_control_plane_activity.resource_group,

azure_control_plane_activity.normalized_identity_id,

azure_control_plane_activity.source_ip,

azure_control_plane_activity.user_agent,

azure_control_plane_activity.application_id,

azure_control_plane_activity.service_principal_id,

azure_control_plane_activity.managed_identity_id,

azure_control_plane_activity.role_definition_id,

azure_control_plane_activity.event_name,

azure_control_plane_activity.resource_id,

joomla_azure_context.joomla_site_id,

joomla_azure_context.type

EMIT alert WHEN

count_distinct(azure_control_plane_activity.event_name) >= ENV_MIN_DISTINCT_AZURE_CONTROL_PLANE_RISK_EVENTS

OR azure_control_plane_activity.event_name IN ENV_HIGH_RISK_AZURE_EVENTS_REQUIRING_REVIEW

OR azure_control_plane_activity.managed_identity_id IS NEW_FOR azure_control_plane_activity.normalized_identity_id WITHIN ENV_AZURE_MANAGED_IDENTITY_NOVELTY_WINDOW

OR azure_control_plane_activity.defender_for_cloud_alert_type IN ENV_RELEVANT_DEFENDER_FOR_CLOUD_ALERTS

OR azure_control_plane_activity.sentinel_incident_type IN ENV_RELEVANT_SENTINEL_INCIDENT_TYPES

GCP

Detection Viability Assessment

Production-deployable only where Joomla web infrastructure, hosting workflows, cloud workloads, storage, secrets, identity, logging, or administrative activity is hosted in or connected to Google Cloud. Google Cloud is not a primary detection layer for Joomla extension upload abuse itself because the core behavior begins in web application, extension, webroot, endpoint, and egress telemetry. Google Cloud becomes viable when suspicious Joomla extension upload or webshell behavior can be correlated to Google Cloud Admin Activity logs, Data Access logs, IAM logs, Cloud Identity logs, service-account activity, Cloud Storage access, Secret Manager access, Cloud KMS activity, Security Command Center findings, Compute Engine activity, GKE activity, Cloud Run activity, Cloud Logging changes, monitoring changes, VPC flow telemetry, or hosting-control activity.

Rule

Google Cloud Activity After Joomla Extension Upload Abuse or Webshell Execution

Rule Format

Google Cloud correlation pseudologic requiring Admin Activity logs, Data Access logs, IAM logs, Cloud Identity logs, service-account logs, Cloud Storage logs, Secret Manager logs, Cloud KMS logs, Security Command Center findings, Chronicle or SIEM context, workload identity mapping, Joomla asset enrichment, approved-role lookups, automation allowlists, source baselines, resource baselines, project baselines, organization baselines, service-account baselines, and time-window mapping.

Detection Purpose

Detect suspicious Google Cloud identity, IAM, service-account, storage, secrets, KMS, logging, monitoring, network, compute, container, or resource-access activity occurring after Joomla extension upload abuse, writable PHP access, endpoint-confirmed webshell execution, rare egress, credential-file access, CMS state change, FTP activity, hosting-control activity, or hosted-content impact involving Google Cloud-hosted Joomla assets or Google Cloud-connected hosting workflows.

Detection Logic

Trigger when suspicious Google Cloud activity occurs within a defined correlation window after locally enriched Joomla extension upload abuse or webshell execution context.

Assign medium severity when Google Cloud activity follows suspicious Joomla upload or webshell context but remains limited to low-risk enumeration, benign-looking resource access, unusual source behavior, anomalous project context, or anomalous service-account context requiring review.

Assign high severity when Google Cloud activity includes IAM policy or role changes, service-account key activity, service-account impersonation, Workload Identity changes, Workforce Identity Federation activity, Cloud Storage enumeration or object access, Secret Manager access, KMS access, Compute Engine changes, GKE changes, Cloud Run changes, logging or monitoring modification, network exposure changes, or Security Command Center findings.

Promote to critical when Google Cloud activity includes privilege escalation, service-account key creation, service-account impersonation, IAM policy modification, Secret Manager secret retrieval, KMS decrypt activity, sensitive Cloud Storage access, logging or monitoring disablement, Security Command Center suppression, public exposure of resources, destructive resource activity, or confirmed use of Joomla-derived credentials or webshell-originated Google Cloud access.

Required Telemetry

·        Google Cloud Admin Activity logs.

·        Google Cloud Data Access logs where applicable.

·        Google Cloud IAM logs.

·        Google Cloud service-account logs.

·        Google Cloud Cloud Identity logs where applicable.

·        Google Cloud Storage logs.

·        Google Cloud Secret Manager logs.

·        Google Cloud KMS logs.

·        Google Cloud Security Command Center findings.

·        Google Cloud VPC Flow Logs where applicable.

·        Google Cloud DNS logs where applicable.

·        Google Cloud Logging and Monitoring activity.

·        Google Cloud Compute Engine activity where applicable.

·        Google Kubernetes Engine activity where applicable.

·        Cloud Run or App Engine activity where applicable.

·        Chronicle, SIEM, data-lake, or analytics context where applicable.

·        Joomla-to-Google Cloud workload mapping.

·        Joomla public asset to Google Cloud organization, folder, project, and resource mapping.

·        Joomla site to Compute Engine, GKE, Cloud Run, App Engine, Cloud Storage, Secret Manager, KMS, service account, workload identity, or resource mapping.

·        Locally enriched Joomla upload or webshell context.

·        Approved Google Cloud automation identity lookup.

·        Approved service-account lookup.

·        Approved CI/CD or IaC identity lookup.

·        Approved break-glass identity lookup.

·        Approved security-tooling identity lookup.

·        Approved incident-response identity lookup.

·        Expected organization, folder, project, resource, role, source, service-account, workload-identity, and user-agent baselines.

·        Sensitive Google Cloud resource lookup.

Engineering Implementation Instructions

Map organization ID, folder ID, project ID, normalized user ID, principal email, user principal name, Google account ID, service account ID, service account key ID, workload identity subject, workforce identity federation subject, source IP, user agent, method name, service name, resource name, resource type, role name, permission name, policy delta, binding delta, Cloud Storage bucket name, Cloud Storage object name, Secret Manager secret name, KMS key name, Compute instance ID, GKE cluster identity, Cloud Run service name, App Engine service name, VPC network, firewall rule name, Security Command Center finding type, correlation ID, request metadata, response status, and event timestamp.

Create or ingest a normalized joomla_gcp_context view from Joomla web telemetry, WAF logs, reverse-proxy logs, CDN logs, load-balancer logs, endpoint telemetry, EDR telemetry, DNS logs, proxy logs, firewall logs, CMS state telemetry, FTP telemetry, hosting-control telemetry, hosted-content impact telemetry, Google Cloud workload inventory, Google Cloud organization and project mapping, Google Cloud service-account mapping, Google Cloud identity mapping, and source-enrichment context.

Require the joomla_gcp_context view to include Joomla site ID, public asset, backend host, workload ID, Google Cloud organization ID, project ID, resource name, Compute instance ID, GKE cluster ID, Cloud Run service name, App Engine service name, service account ID, workload identity subject, source IP, destination IP, public asset IP, Cloud Storage bucket name, Secret Manager secret name, KMS key name, webshell execution time, suspicious upload time, rare egress time, credential-file access time, and impact context where available.

Map Joomla-hosted infrastructure to Google Cloud organizations, folders, projects, VPCs, load balancers, Compute Engine instances, GKE clusters, Cloud Run services, App Engine services, Cloud Storage buckets, Secret Manager secrets, KMS keys, service accounts, IAM roles, logging sinks, monitoring configuration, and Security Command Center coverage.

Require Google Cloud organization and project lineage plus at least one stronger workload, identity, source, resource, host, Cloud Storage, Secret Manager, KMS, service-account, workload-identity, or correlation-ID linkage before correlating Google Cloud activity to Joomla compromise context. Organization, folder, project, and region should support anomaly assessment, grouping, and triage, not act as standalone correlation keys.

Tune approved automation, service accounts, CI/CD, IaC, break-glass, security-tooling, incident-response, backup, monitoring, hosting-provider, platform, and maintenance workflows.

Treat Data Access log enablement, Cloud Storage data-event coverage, Secret Manager logging, KMS logging, Security Command Center coverage, Chronicle or SIEM ingestion, workload-to-project mapping, source-IP preservation, identity-to-host mapping, service-account inventory freshness, and SOC routing as required local deployment work.

DRI Assessment

Moderate-to-high resilience where Joomla infrastructure is Google Cloud-hosted or Google Cloud-connected and where Google Cloud identity, resource, source, service-account, and workload telemetry can be tied back to Joomla site context through organization and project lineage plus stronger workload, identity, source, resource, host, Cloud Storage, Secret Manager, KMS, service-account, workload-identity, or correlation-ID linkage. Lower resilience where Joomla is not hosted in Google Cloud, Data Access logs are disabled, Cloud Storage or Secret Manager logging is incomplete, workload identity mapping is incomplete, source IP is masked by hosting infrastructure, or Google Cloud activity cannot be correlated to the affected Joomla site or host.

DRI

8.2 / 10

TCR Assessment

Operational confidence is strongest when suspicious Google Cloud activity follows confirmed Joomla upload abuse, writable PHP access, webshell execution, credential-file access, rare egress, or CMS impact involving Google Cloud-hosted assets. Confidence is lower when Google Cloud activity only shares broad organization, project, source, service-account, or timing context without Joomla workload lineage.

Operational TCR

7.9 / 10

Full-Telemetry TCR

8.9 / 10

Limitations

Google Cloud telemetry does not directly detect Joomla extension upload abuse unless Joomla infrastructure, hosting workflows, or attacker follow-on activity touch Google Cloud services. This rule is not applicable to Joomla sites hosted entirely outside Google Cloud without Google Cloud-connected identity, storage, secrets, logging, compute, or hosting-control workflows. Admin Activity logs, Data Access logs, IAM logs, Cloud Storage logs, Secret Manager logs, KMS logs, Security Command Center findings, Chronicle or SIEM ingestion, resource diagnostics, and workload mapping must be enabled where relevant. Organization, folder, project, or region alone must not be used as correlation keys because they can over-correlate unrelated activity in the same cloud environment. Legitimate automation, service accounts, CI/CD, IaC, break-glass access, security tooling, backup workflows, hosting-provider operations, platform operations, and incident-response activity can resemble suspicious Google Cloud activity and must be explicitly allowlisted.

Detection Query Pattern

Use this pattern as implementation-ready Google Cloud correlation pseudologic and map all Google Cloud audit fields, identity fields, service-account fields, cloud-resource fields, Cloud Storage fields, Secret Manager fields, KMS fields, Security Command Center fields, Joomla Google Cloud-context fields, approved-role lookups, automation allowlists, source baselines, resource baselines, project baselines, organization baselines, service-account baselines, and time windows to the target Chronicle, SIEM, data-lake, or analytics environment before deployment.

joomla_gcp_context represents a normalized correlation view derived from Joomla web logs, WAF logs, reverse-proxy logs, CDN logs, load-balancer logs, endpoint logs, EDR logs, Linux audit logs, file-integrity logs, DNS logs, proxy logs, firewall logs, CMS state telemetry, FTP telemetry, hosting-control telemetry, hosted-content impact telemetry, Google Cloud workload inventory, Google Cloud organization mapping, Google Cloud folder mapping, Google Cloud project mapping, Google Cloud resource mapping, Google Cloud service-account mapping, Google Cloud identity mapping, and source-enrichment context.

gcp_cloud_activity represents a normalized Google Cloud activity view derived from Google Cloud Admin Activity logs, Data Access logs, IAM logs, service-account logs, Cloud Storage logs, Secret Manager logs, Cloud KMS logs, Security Command Center events, Cloud Identity logs, Chronicle context, identity context, network context, proxy context, endpoint context, and source-enrichment context.

Local teams must create, map, or enrich both views before deploying the Google Cloud correlation pattern.

FROM gcp_cloud_activity,

joomla_gcp_context

WHERE gcp_cloud_activity.principal_email IS NOT NULL

AND joomla_gcp_context.event_time IS NOT NULL

AND gcp_cloud_activity.event_time BETWEEN joomla_gcp_context.event_time AND joomla_gcp_context.event_time + ENV_JOOMLA_TO_GCP_CLOUD_WINDOW

AND joomla_gcp_context.joomla_site_id IS NOT NULL

AND joomla_gcp_context.organization_id = gcp_cloud_activity.organization_id

AND joomla_gcp_context.project_id = gcp_cloud_activity.project_id

AND (

joomla_gcp_context.resource_name = gcp_cloud_activity.resource_name

OR joomla_gcp_context.compute_instance_id = gcp_cloud_activity.compute_instance_id

OR joomla_gcp_context.gke_cluster_id = gcp_cloud_activity.gke_cluster_id

OR joomla_gcp_context.cloud_run_service_name = gcp_cloud_activity.cloud_run_service_name

OR joomla_gcp_context.app_engine_service_name = gcp_cloud_activity.app_engine_service_name

OR joomla_gcp_context.service_account_id = gcp_cloud_activity.service_account_id

OR joomla_gcp_context.workload_identity_subject = gcp_cloud_activity.workload_identity_subject

OR joomla_gcp_context.source_ip = gcp_cloud_activity.source_ip

OR joomla_gcp_context.destination_ip = gcp_cloud_activity.source_ip

OR joomla_gcp_context.public_asset_ip = gcp_cloud_activity.source_ip

OR joomla_gcp_context.backend_host = gcp_cloud_activity.host_name

OR joomla_gcp_context.storage_bucket_name = gcp_cloud_activity.storage_bucket_name

OR joomla_gcp_context.secret_name = gcp_cloud_activity.secret_name

OR joomla_gcp_context.kms_key_name = gcp_cloud_activity.kms_key_name

OR joomla_gcp_context.correlation_id = gcp_cloud_activity.correlation_id

)

AND joomla_gcp_context.type IN (

"suspicious_joomla_extension_upload",

"joomla_writable_php_access_after_upload",

"joomla_endpoint_webshell_execution",

"joomla_sensitive_file_access",

"joomla_credential_file_access",

"joomla_database_access_or_dump",

"joomla_rare_egress_after_upload",

"joomla_admin_or_super_user_creation",

"joomla_cms_state_change",

"joomla_ftp_abuse",

"joomla_hosting_control_abuse",

"joomla_hosted_content_tampering",

"joomla_phishing_or_malware_hosting",

"joomla_spam_infrastructure"

)

AND (

gcp_cloud_activity.method_name IN ENV_SUSPICIOUS_GCP_ADMIN_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_IAM_POLICY_OR_ROLE_CHANGE_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_SERVICE_ACCOUNT_CREDENTIAL_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_SERVICE_ACCOUNT_IMPERSONATION_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_WORKLOAD_IDENTITY_CHANGE_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_WORKFORCE_IDENTITY_FEDERATION_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_STORAGE_RISK_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_SECRET_MANAGER_RISK_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_KMS_RISK_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_LOGGING_OR_MONITORING_MODIFICATION_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_SECURITY_CONTROL_MODIFICATION_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_SECURITY_COMMAND_CENTER_SUPPRESSION_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_NETWORK_EXPOSURE_CHANGE_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_COMPUTE_MODIFICATION_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_GKE_MODIFICATION_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_CLOUD_RUN_MODIFICATION_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_APP_ENGINE_MODIFICATION_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_PROJECT_OR_ORGANIZATION_ADMIN_METHODS

OR gcp_cloud_activity.security_command_center_finding_type IN ENV_RELEVANT_SECURITY_COMMAND_CENTER_FINDINGS

)

AND (

gcp_cloud_activity.source_ip NOT IN ENV_APPROVED_GCP_ADMIN_SOURCE_IPS

OR gcp_cloud_activity.user_agent NOT IN ENV_EXPECTED_GCP_USER_AGENTS_BY_ROLE

OR gcp_cloud_activity.organization_id NOT IN ENV_EXPECTED_GCP_ORGANIZATIONS_BY_USER_OR_ROLE

OR gcp_cloud_activity.project_id NOT IN ENV_EXPECTED_GCP_PROJECTS_BY_USER_OR_ROLE

OR gcp_cloud_activity.resource_name NOT IN ENV_EXPECTED_GCP_RESOURCES_BY_USER_OR_ROLE

OR gcp_cloud_activity.role_name NOT IN ENV_EXPECTED_GCP_ROLES_BY_USER_OR_ROLE

OR gcp_cloud_activity.service_account_id NOT IN ENV_EXPECTED_GCP_SERVICE_ACCOUNTS_BY_USER_OR_ROLE

OR gcp_cloud_activity.workload_identity_subject NOT IN ENV_EXPECTED_GCP_WORKLOAD_IDENTITIES_BY_USER_OR_ROLE

OR gcp_cloud_activity.service_account_key_id IS NEW_FOR gcp_cloud_activity.normalized_user_id WITHIN ENV_GCP_SERVICE_ACCOUNT_KEY_NOVELTY_WINDOW

OR gcp_cloud_activity.resource_name IN ENV_SENSITIVE_GCP_RESOURCES

OR gcp_cloud_activity.storage_bucket_name IN ENV_SENSITIVE_GCP_STORAGE_BUCKETS

OR gcp_cloud_activity.secret_name IN ENV_SENSITIVE_GCP_SECRETS

OR gcp_cloud_activity.kms_key_name IN ENV_SENSITIVE_GCP_KMS_KEYS

OR gcp_cloud_activity.method_name IN ENV_HIGH_RISK_GCP_METHODS_REQUIRING_REVIEW

)

AND NOT (

gcp_cloud_activity.principal_email IN ENV_APPROVED_GCP_AUTOMATION_IDENTITIES

AND gcp_cloud_activity.source_ip IN ENV_APPROVED_GCP_AUTOMATION_SOURCE_IPS

AND gcp_cloud_activity.method_name IN ENV_APPROVED_GCP_AUTOMATION_METHODS

AND gcp_cloud_activity.resource_name NOT IN ENV_SENSITIVE_GCP_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

gcp_cloud_activity.service_account_id IN ENV_APPROVED_GCP_SERVICE_ACCOUNTS

AND gcp_cloud_activity.source_ip IN ENV_APPROVED_GCP_SERVICE_ACCOUNT_SOURCE_IPS

AND gcp_cloud_activity.method_name IN ENV_APPROVED_GCP_SERVICE_ACCOUNT_METHODS

AND gcp_cloud_activity.resource_name NOT IN ENV_SENSITIVE_GCP_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

gcp_cloud_activity.principal_email IN ENV_APPROVED_CICD_OR_IAC_IDENTITIES

AND gcp_cloud_activity.source_ip IN ENV_APPROVED_CICD_OR_IAC_SOURCE_IPS

AND gcp_cloud_activity.method_name IN ENV_APPROVED_CICD_OR_IAC_GCP_METHODS

AND gcp_cloud_activity.resource_name NOT IN ENV_SENSITIVE_GCP_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

gcp_cloud_activity.principal_email IN ENV_APPROVED_BREAK_GLASS_IDENTITIES

AND gcp_cloud_activity.source_ip IN ENV_APPROVED_BREAK_GLASS_SOURCE_IPS

AND gcp_cloud_activity.method_name IN ENV_APPROVED_BREAK_GLASS_GCP_METHODS

AND gcp_cloud_activity.resource_name NOT IN ENV_SENSITIVE_GCP_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

gcp_cloud_activity.principal_email IN ENV_APPROVED_SECURITY_TOOLING_IDENTITIES

AND gcp_cloud_activity.source_ip IN ENV_APPROVED_SECURITY_TOOLING_SOURCE_IPS

AND gcp_cloud_activity.method_name IN ENV_APPROVED_SECURITY_TOOLING_GCP_METHODS

AND gcp_cloud_activity.resource_name NOT IN ENV_SENSITIVE_GCP_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

gcp_cloud_activity.principal_email IN ENV_APPROVED_INCIDENT_RESPONSE_IDENTITIES

AND gcp_cloud_activity.source_ip IN ENV_APPROVED_INCIDENT_RESPONSE_SOURCE_IPS

AND gcp_cloud_activity.method_name IN ENV_APPROVED_INCIDENT_RESPONSE_GCP_METHODS

AND gcp_cloud_activity.resource_name NOT IN ENV_SENSITIVE_GCP_RESOURCES_REQUIRING_REVIEW

)

AND NOT (

gcp_cloud_activity.principal_email IN ENV_APPROVED_HOSTING_PROVIDER_OR_PLATFORM_IDENTITIES

AND gcp_cloud_activity.source_ip IN ENV_APPROVED_HOSTING_PROVIDER_OR_PLATFORM_SOURCE_IPS

AND gcp_cloud_activity.method_name IN ENV_APPROVED_HOSTING_PROVIDER_OR_PLATFORM_GCP_METHODS

AND gcp_cloud_activity.resource_name NOT IN ENV_SENSITIVE_GCP_RESOURCES_REQUIRING_REVIEW

)

AND gcp_cloud_activity.principal_email NOT IN ENV_ACTIVE_INVESTIGATION_SUPPRESSIONS

GROUP BY gcp_cloud_activity.organization_id,

gcp_cloud_activity.project_id,

gcp_cloud_activity.normalized_user_id,

gcp_cloud_activity.principal_email,

gcp_cloud_activity.service_account_id,

gcp_cloud_activity.source_ip,

gcp_cloud_activity.user_agent,

gcp_cloud_activity.method_name,

gcp_cloud_activity.resource_name,

joomla_gcp_context.joomla_site_id,

joomla_gcp_context.type

EMIT alert WHEN

count_distinct(gcp_cloud_activity.method_name) >= ENV_MIN_DISTINCT_GCP_RISK_METHODS

OR gcp_cloud_activity.method_name IN ENV_HIGH_RISK_GCP_METHODS_REQUIRING_REVIEW

OR gcp_cloud_activity.method_name IN ENV_GCP_SECURITY_CONTROL_MODIFICATION_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_SECRET_MANAGER_RISK_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_STORAGE_RISK_METHODS

OR gcp_cloud_activity.method_name IN ENV_GCP_SERVICE_ACCOUNT_CREDENTIAL_METHODS

OR gcp_cloud_activity.service_account_key_id IS NEW_FOR gcp_cloud_activity.normalized_user_id WITHIN ENV_GCP_SERVICE_ACCOUNT_KEY_NOVELTY_WINDOW

OR gcp_cloud_activity.security_command_center_finding_type IN ENV_RELEVANT_SECURITY_COMMAND_CENTER_FINDINGS

S26 Threat-to-Rule Traceability Matrix

Traceability Purpose

This section maps the primary behavioral threat conditions in this report to the S25 detection coverage developed across NDR / Network Behavioral Analytics, SentinelOne, Splunk, Elastic, QRadar, SIGMA, YARA, AWS, Azure, and GCP.

The traceability model is behavior-led. It does not rely on a single CVE label, extension name, exploit name, request path, source IP, user-agent value, payload string, file hash, PHP function name, webshell string, scanner signature, campaign name, actor branding, tool name, or static indicator as the basis for coverage.

Coverage Scope

The S25 rule set provides coverage for the observable enterprise sequence associated with suspicious Joomla extension upload or import activity, attacker-controlled upload-path enablement, PHP-like file placement in writable or extension-owned web paths, HTTP access to PHP-like artifacts, web server service-context execution, rare outbound communication, sensitive Joomla file access, database access, CMS state changes, FTP activity, hosting-control activity, hosted-content tampering, and downstream cloud activity.

Coverage is strongest where Joomla web telemetry, WAF logs, reverse-proxy logs, CDN logs, load-balancer logs, endpoint telemetry, EDR telemetry, Linux audit logs, file-integrity logs, DNS logs, proxy logs, firewall logs, CMS state telemetry, FTP telemetry, hosting-control telemetry, hosted-content impact telemetry, SIEM correlation, and cloud telemetry can be joined into bounded behavioral sequences.

Primary Coverage Areas

·        Suspicious Joomla extension upload, profile-import, custom-icon upload, asset upload, image upload, media upload, or AJAX upload activity involving unusual source infrastructure, abnormal request timing, abnormal request size, abnormal response size, abnormal status sequence, suspicious upload content type, or route behavior tied to Joomla extension upload functionality

·        JCE profile-import behavior involving option=com_jce and task=profiles.import when correlated with Joomla public asset context, approved-source exclusions, and follow-on activity

·        SP Page Builder upload behavior involving com_sppagebuilder, asset.uploadCustomIcon, custom-icon upload paths, or related extension upload activity when correlated with Joomla public asset context and follow-on activity

·        Page Builder CK upload behavior involving com_pagebuilderck, browse.ajaxAddPicture, image upload, media upload, AJAX upload, or extension-owned upload behavior when correlated with Joomla public asset context and follow-on activity

·        PHP-like file access in Joomla writable, media, image, upload, tmp, cache, asset, iconfont, gfonts, template, plugin, component, module, or extension-owned webroot paths after suspicious extension upload activity

·        Web server service-context execution, shell or scripting interpreter use, transfer-tool use, archive-tool use, database-tool use, command execution, or suspicious process behavior after suspicious Joomla upload activity

·        Sensitive Joomla file access, credential-file access, database access or dump behavior, CMS administrator or Super User creation, template modification, plugin modification, redirect modification, mail-script modification, cron modification, .htaccess modification, FTP activity, hosting-control activity, or hosted-content impact after suspicious upload activity

·        Rare outbound communication, suspicious destination behavior, new or rare domain access, unusual destination geography, unusual egress port, suspicious ASN, proxy action, firewall action, or destination reputation signal after suspicious Joomla upload activity

·        Downstream AWS, Azure, and GCP activity following suspicious Joomla upload, webshell, credential access, rare egress, CMS impact, FTP abuse, hosting-control abuse, or hosted-content impact context

Traceability Mapping

Suspicious Joomla Extension Upload or Import Activity

This behavior is covered where Joomla web, WAF, reverse-proxy, CDN, load-balancer, source-enrichment, extension-route, request-size, response-size, status-sequence, user-agent, and SIEM telemetry can be correlated around public Joomla assets and extension upload or import functionality.

Mapped Coverage

·        NDR / Network Behavioral Analytics coverage for suspicious Joomla extension upload routes, rare or suspicious source infrastructure, abnormal request timing, abnormal request size, abnormal response size, upload-to-access sequencing, and source-to-site deviation

·        Splunk, Elastic, QRadar, and SIGMA coverage for suspicious Joomla extension upload or import behavior when request, source, Joomla site ID, public asset, virtual host, backend host, workload, extension family, route, status, size, and timing fields are normalized or enriched

·        SentinelOne supporting coverage where suspicious Joomla upload activity can be joined to endpoint service-context behavior, writable PHP artifact activity, sensitive-file access, or rare egress from the Joomla host

·        AWS, Azure, and GCP downstream coverage only when suspicious Joomla upload activity can be joined to later cloud activity through workload, identity, source, host, resource, storage, secret, KMS, service-account, or correlation context

Coverage Qualification

·        A single extension route is not sufficient

·        A single POST request is not sufficient

·        A single source IP is not sufficient

·        A single user-agent value is not sufficient

·        A single upload-sized request is not sufficient

·        A single extension name is not sufficient

·        Reliable Joomla site, public asset, source, route, timing, upload behavior, writable-path, endpoint, egress, CMS, hosting-control, or downstream activity linkage must exist

·        Approved administrators, scanners, hosting-provider support, validation sources, deployment workflows, backup workflows, migration workflows, maintenance windows, malware cleanup, emergency remediation, and known extension update activity require suppression or downgrade when expected context aligns

Writable PHP Web Access After Joomla Upload Activity

This behavior is covered where suspicious Joomla upload or import activity can be correlated to HTTP access of PHP-like artifacts in Joomla writable, media, image, upload, tmp, cache, template, plugin, component, module, or extension-owned webroot paths.

Mapped Coverage

·        NDR / Network Behavioral Analytics coverage for upload-to-PHP-access sequencing, writable-path PHP access, webshell-like timing, unusual status sequences, response-size deviation, rare user-agent behavior, and source-to-site continuity

·        Splunk, Elastic, QRadar, and SIGMA coverage for suspicious upload activity followed by PHP-like artifact access where Joomla site ID, public asset, virtual host, backend host, workload, source, writable path family, uploaded path, and PHP-like artifact fields are normalized or enriched

·        SentinelOne supporting coverage where PHP-like file activity, file creation, modification, rename, execution-adjacent behavior, or process behavior is observed on the Joomla host

·        Cloud coverage only when writable PHP access can be joined to later AWS, Azure, or GCP activity through reliable workload, identity, source, host, resource, storage, secret, or correlation context

Coverage Qualification

·        PHP file access alone is not sufficient

·        A writable path alone is not sufficient

·        A PHP-like filename alone is not sufficient

·        A 200, 302, 403, 404, or 500 response alone is not sufficient

·        Response-size deviation alone is not sufficient

·        Reliable prior upload activity, same-site continuity, source continuity, writable-path lineage, uploaded-path lineage, backend-host lineage, workload lineage, endpoint context, or downstream impact must exist

·        Legitimate plugin updates, template edits, media workflows, backup jobs, restore activity, scanner validation, hosting-provider support, incident-response cleanup, and emergency remediation require local baseline validation

Web Server Service-Context Execution and Endpoint Impact

This behavior is covered where endpoint, EDR, Linux audit, process, file, command-line, web server user, parent-process, PHP runtime, and Joomla host telemetry can identify suspicious host behavior after Joomla upload or webshell context.

Mapped Coverage

·        SentinelOne coverage for web server service-context execution, suspicious child processes, transfer-tool use, archive-tool use, database-tool use, scripting interpreter use, sensitive-file access, writable PHP artifact activity, and rare egress from Joomla hosts

·        Splunk, Elastic, and QRadar coverage where endpoint telemetry and Joomla web telemetry are ingested into the same analytics environment and can be joined through site, host, workload, source, endpoint, file, process, or timing context

·        SIGMA coverage only where the target backend maps endpoint and Joomla enrichment fields into local event-rule templates and performs backend-native correlation

·        NDR / Network Behavioral Analytics supporting coverage where host-to-destination communication, unusual egress, callback behavior, or source-to-destination deviation follows suspicious Joomla upload activity

Coverage Qualification

·        Endpoint process activity alone is not sufficient

·        Web server user context alone is not sufficient

·        A shell, scripting interpreter, archive tool, transfer tool, or database tool alone is not sufficient

·        File creation in a writable directory alone is not sufficient

·        Sensitive-file access alone is not sufficient

·        Coverage is strongest when endpoint activity follows suspicious Joomla upload, writable PHP access, webshell-like HTTP behavior, rare egress, CMS state change, or credential-file access within a bounded window

·        Legitimate administration, plugin installation, template maintenance, backup, migration, malware cleanup, emergency remediation, hosting-provider support, and approved deployment workflows require suppression or downgrade when expected context aligns

Sensitive Joomla File Access, Credential Access, and Database Activity

This behavior is covered where file, process, command-line, database-tool, Linux audit, EDR, sensitive-file, Joomla configuration, and SIEM telemetry can identify suspicious access to Joomla credential or configuration data after upload or webshell context.

Mapped Coverage

·        SentinelOne coverage for Joomla credential-file access, sensitive-file access, database-tool execution, archive activity, command-line patterns, and web server service-context access to sensitive local files

·        Splunk, Elastic, and QRadar coverage where sensitive-file, endpoint, process, command-line, database, and Joomla web telemetry can be joined to prior suspicious upload activity

·        SIGMA supporting coverage where local enrichment identifies joomla.file.sensitive_file_access, credential-access command patterns, database access, or database dump behavior after suspicious upload context

·        AWS, Azure, and GCP coverage only when credential access leads to cloud-resource, secret, storage, identity, or control-plane activity tied back to Joomla context

Coverage Qualification

·        Access to configuration.php alone is not sufficient

·        Database-tool execution alone is not sufficient

·        Archive activity alone is not sufficient

·        Credential-access command text alone is not sufficient

·        Coverage requires prior suspicious Joomla upload activity, writable PHP access, webshell execution context, web server service context, same-host lineage, same-site lineage, or downstream impact context

·        Backup jobs, legitimate administrative troubleshooting, migration activity, hosting-provider support, incident-response collection, and approved security tooling require local baseline validation

Rare Egress and Suspicious Destination Activity

This behavior is covered where DNS, proxy, firewall, NDR, endpoint, destination reputation, destination first-seen, domain age, ASN, geography, destination port, and Joomla host mapping can identify unusual outbound communication after suspicious Joomla upload activity.

Mapped Coverage

·        NDR / Network Behavioral Analytics coverage for rare destination access, unusual egress ports, suspicious ASN, new or rare domains, abnormal destination geography, proxy or firewall anomalies, and upload-to-egress sequencing

·        SentinelOne supporting coverage for rare egress from a Joomla host after web server service-context execution or suspicious PHP artifact activity

·        Splunk, Elastic, QRadar, and SIGMA coverage where DNS, proxy, firewall, endpoint, destination, reputation, first-seen, ASN, geography, destination-port, and Joomla site context are normalized or enriched

·        Cloud coverage only where rare egress or Joomla compromise context can be joined to cloud identity, storage, secrets, resource, workload, or control-plane activity

Coverage Qualification

·        Rare egress alone is not sufficient

·        A suspicious domain alone is not sufficient

·        Destination reputation alone is not sufficient

·        Unusual port alone is not sufficient

·        New domain age alone is not sufficient

·        Coverage requires prior suspicious Joomla upload behavior, writable PHP access, webshell-like behavior, same-host lineage, same-site lineage, endpoint execution context, or cloud-impact context

·        Approved update services, monitoring, CDN, backup, hosting-provider, security tooling, vulnerability validation, and incident-response destinations require local allowlisting

CMS State Change, FTP Activity, Hosting-Control Activity, and Hosted-Content Impact

This behavior is covered where Joomla administrative state, CMS change telemetry, FTP logs, hosting-control activity, webroot file activity, hosted-content monitoring, phishing or malware hosting indicators, spam infrastructure indicators, and SIEM enrichment can be joined to prior suspicious upload or webshell context.

Mapped Coverage

·        Splunk, Elastic, QRadar, and SIGMA coverage for suspicious CMS state change, administrator or Super User creation, template modification, plugin modification, redirect modification, mail-script modification, cron modification, .htaccess modification, FTP activity, hosting-control activity, phishing hosting, malware hosting, spam infrastructure, or hosted-content tampering after suspicious Joomla upload context

·        SentinelOne supporting coverage where file, process, command-line, service-context, or webroot behavior supports CMS impact or hosted-content tampering

·        NDR / Network Behavioral Analytics supporting coverage where hosted-content changes, phishing infrastructure, malware-hosting behavior, spam infrastructure, or traffic shifts are visible through network, DNS, proxy, WAF, or CDN telemetry

·        Cloud coverage only where CMS or hosted-content impact touches AWS, Azure, or Google Cloud storage, secrets, logging, compute, identity, or hosting-control workflows

Coverage Qualification

·        CMS state change alone is not sufficient

·        FTP activity alone is not sufficient

·        Hosting-control activity alone is not sufficient

·        Hosted-content change alone is not sufficient

·        Administrator creation alone is not sufficient

·        Reliable prior suspicious upload, writable PHP access, webshell execution, source continuity, site continuity, host continuity, endpoint context, or hosting-control lineage must exist

·        Legitimate content updates, site administration, hosting-provider support, deployment workflows, SEO workflows, backup or restore activity, migration activity, emergency remediation, and malware cleanup require local baseline validation

Downstream AWS Cloud Activity

This behavior is covered by conditional downstream AWS cloud-impact detection where suspicious Joomla extension upload, writable PHP access, webshell execution, rare egress, credential-file access, CMS state change, FTP activity, hosting-control activity, or hosted-content impact can be joined to AWS activity.

Mapped Coverage

·        AWS coverage for suspicious federated access, IAM Identity Center activity, role assumption, IAM privilege activity, access-key activity, Secrets Manager access, KMS activity, S3 enumeration or access, CloudTrail modification, security-control modification, GuardDuty findings, Security Hub findings, AWS Config activity, Organizations activity, compute changes, network exposure changes, snapshot or image export, and administrative events following suspicious Joomla context

·        Splunk, Elastic, and QRadar coverage where AWS logs and Joomla context are ingested into the same analytics environment

·        SIGMA coverage only where target backends can map AWS events into local event-rule templates and perform backend-native correlation

Coverage Qualification

·        AWS activity alone is not sufficient

·        AWS console access alone is not sufficient

·        IAM activity alone is not sufficient

·        Role assumption alone is not sufficient

·        Secrets Manager, KMS, or S3 access alone is not sufficient

·        Reliable AWS account lineage plus stronger workload, identity, source, host, resource, S3, Secrets Manager, KMS, assumed-role, instance, container, workload, or correlation linkage to suspicious Joomla context must exist

·        CloudTrail data events, GuardDuty, Security Hub, AWS Config, Organizations logs, VPC Flow Logs, Route 53 Resolver logs, sensitive-resource inventories, access-key novelty tracking, and event ordering determine deployment confidence

Downstream Azure Control-Plane and Resource-Access Activity

This behavior is covered by conditional downstream Azure cloud-impact detection where suspicious Joomla extension upload, writable PHP access, webshell execution, rare egress, credential-file access, CMS state change, FTP activity, hosting-control activity, or hosted-content impact can be joined to Azure activity.

Mapped Coverage

·        Azure coverage for Entra ID sign-ins, Entra ID audit events, Azure Activity events, Azure Resource Manager activity, role assignments, service-principal activity, managed-identity activity, Key Vault access, Storage access, logging changes, diagnostic-setting changes, Azure Policy changes, network security changes, App Service changes, VM changes, container workload changes, Defender for Cloud alerts, Sentinel incidents, and sensitive Azure resource access following suspicious Joomla context

·        Splunk, Elastic, and QRadar coverage where Azure logs and Joomla context are ingested into the same analytics environment

·        SIGMA coverage only where target backends can map Azure events into local event-rule templates and perform backend-native correlation

Coverage Qualification

·        Azure activity alone is not sufficient

·        Azure portal access alone is not sufficient

·        Entra ID sign-in activity alone is not sufficient

·        Role assignment alone is not sufficient

·        Key Vault access alone is not sufficient

·        Storage access alone is not sufficient

·        Reliable tenant and subscription lineage plus stronger workload, identity, source, host, resource, Storage, Key Vault, service-principal, managed-identity, application, or correlation-ID linkage to suspicious Joomla context must exist

·        Azure Activity logs, Entra ID logs, Key Vault logging, Storage logging, Defender for Cloud, Sentinel, diagnostic visibility, sensitive-resource inventories, managed-identity novelty tracking, and event ordering determine deployment confidence

Downstream GCP Cloud Activity

This behavior is covered by conditional downstream Google Cloud-impact detection where suspicious Joomla extension upload, writable PHP access, webshell execution, rare egress, credential-file access, CMS state change, FTP activity, hosting-control activity, or hosted-content impact can be joined to Google Cloud activity.

Mapped Coverage

·        GCP coverage for suspicious Google Cloud Admin Activity, Data Access activity, IAM policy changes, role changes, service-account activity, service-account credential activity, service-account impersonation, workload identity federation, workforce identity federation, Cloud Storage access, Secret Manager access, Cloud KMS activity, logging changes, monitoring changes, Security Command Center findings, Security Command Center suppression, network exposure changes, compute changes, GKE changes, Cloud Run changes, App Engine changes, project administration, organization administration, and sensitive resource access following suspicious Joomla context

·        Splunk, Elastic, and QRadar coverage where Google Cloud audit logs and Joomla context are ingested into the same analytics environment

·        SIGMA coverage only where target backends can map Google Cloud events into local event-rule templates and perform backend-native correlation

Coverage Qualification

·        Google Cloud activity alone is not sufficient

·        Google Cloud console access alone is not sufficient

·        Service-account activity alone is not sufficient

·        Cloud Storage, Secret Manager, or Cloud KMS access alone is not sufficient

·        Reliable organization and project lineage plus stronger workload, identity, source, host, resource, Cloud Storage, Secret Manager, KMS, service-account, workload-identity, or correlation-ID linkage to suspicious Joomla context must exist

·        Data Access logging, Cloud Storage logging, Secret Manager logging, Cloud KMS visibility, Cloud Identity telemetry, Security Command Center context, audit coverage, service-account baseline quality, sensitive-resource inventories, and event ordering determine deployment confidence

NDR / Network Behavioral Analytics Coverage Disposition

NDR / Network Behavioral Analytics provides primary network-behavior and supporting sequence coverage where suspicious Joomla extension upload activity, writable PHP access, rare egress, webshell-like behavior, DNS activity, proxy activity, firewall activity, hosted-content impact, or downstream cloud activity can be paired with network behavior.

Coverage may include suspicious Joomla extension upload routes, unusual source infrastructure, rare ASN, rare geography, abnormal request timing, abnormal request size, abnormal response size, suspicious upload content type, abnormal status sequence, upload-to-PHP-access sequencing, rare destination access, new or rare domains, unusual egress ports, suspicious destination reputation, proxy anomalies, firewall anomalies, hosted-content behavior, or cloud access paths.

NDR cannot independently prove Joomla exploitation, PHP webshell execution, credential theft, database theft, CMS compromise, hosting-control compromise, AWS compromise, Azure compromise, Google Cloud compromise, downstream cloud compromise, or data theft without web, endpoint, CMS, hosting-control, cloud, or SIEM-forwarded context.

SIGMA Coverage Disposition

SIGMA provides portable event-rule template coverage for suspicious Joomla extension upload context, writable PHP access, endpoint or egress impact, CMS state change, FTP activity, hosting-control activity, and hosted-content impact.

SIGMA is useful as event-level detection logic but should not be treated as a complete backend-independent sequence-correlation layer for this report. Local field mapping, enrichment-field creation, backend conversion, exception validation, and SIEM-native correlation are required.

SIGMA event rules support traceability for suspicious upload-to-PHP-access, upload-to-endpoint-impact, upload-to-egress, and upload-to-CMS-impact behavior, but the target backend must implement temporal correlation between Joomla web activity, endpoint telemetry, file telemetry, DNS, proxy, firewall, CMS state, hosting-control activity, and downstream cloud activity.

YARA Coverage Disposition

YARA has zero deployable rules for this EXP report.

YARA is not viable as a primary S25 detection system because the report’s detection model is behavioral, sequence-based, web-telemetry driven, SIEM-correlation based, endpoint-context based, egress-correlation based, CMS-impact based, hosting-control-context based, and downstream cloud-correlation based rather than static-file, malware-signature, or artifact-matching based.

YARA may provide limited supporting value only if a confirmed malicious PHP artifact, webshell body, encoded payload, loader, dropper, script artifact, archive artifact, memory artifact, configuration implant, or reusable malware family artifact is recovered and independently validated.

Final YARA Outcome

No YARA rules survive.

Coverage Gaps and Non-Coverage Conditions

The S25 rule set does not directly prove Joomla exploitation, PHP webshell execution, credential theft, database theft, CMS compromise, FTP compromise, hosting-control compromise, AWS compromise, Azure compromise, Google Cloud compromise, downstream cloud compromise, or data theft by itself.

Coverage Weakens Under the Following Conditions

·        Joomla web, WAF, reverse-proxy, CDN, load-balancer, or access telemetry is unavailable, delayed, truncated, or not retained

·        Joomla public assets are not consistently tagged by site ID, virtual host, backend host, workload, tenant, account, subscription, project, hosting provider, or exposure state

·        Joomla extension upload routes, JCE profile-import routes, SP Page Builder routes, Page Builder CK routes, generic media upload routes, AJAX upload routes, writable paths, extension-owned paths, or PHP-like artifact patterns are not maintained

·        URI paths, query strings, HTTP method, user agent, content type, request size, response size, HTTP status, source IP, forwarded source IP, or timing fields are unavailable or not normalized

·        Source IP attribution is unstable or hidden behind shared VPN, proxy, NAT, CDN, hosting-provider, scanner, or validation infrastructure

·        Upload-to-PHP-access, upload-to-endpoint-impact, upload-to-egress, upload-to-CMS-impact, or upload-to-cloud correlation windows are not tuned

·        Endpoint or EDR telemetry from Joomla hosts is unavailable, incomplete, delayed, or not mapped to web server service context

·        Linux audit, file-integrity, file-path, file-name, process, command-line, parent-process, process-user, or PHP runtime telemetry is unavailable

·        Sensitive Joomla file patterns, credential-file access patterns, database-tool patterns, archive-tool patterns, transfer-tool patterns, shell interpreter lists, scripting interpreter lists, and command-pattern references are missing or stale

·        DNS, proxy, firewall, NDR, destination reputation, destination first-seen, domain age, ASN, geography, or egress-port telemetry is unavailable or not joined to Joomla host context

·        CMS state changes, administrator creation, Super User creation, plugin modification, template modification, redirect modification, mail-script modification, cron modification, .htaccess modification, FTP activity, hosting-control activity, or hosted-content impact telemetry is unavailable or not normalized

·        Approved administrator sources, scanner sources, hosting-provider support sources, validation sources, deployment workflows, backup workflows, migration workflows, maintenance windows, cleanup windows, emergency remediation workflows, approved process baselines, approved file paths, approved command patterns, and approved egress destinations are not tightly scoped

·        CloudTrail management events, CloudTrail data events, GuardDuty, Security Hub, AWS Config, AWS Organizations, VPC Flow Logs, Route 53 Resolver logs, or AWS sensitive-resource inventories are disabled or incomplete

·        Azure Activity, Entra ID, Key Vault diagnostics, Storage logging, Defender for Cloud, Sentinel, resource diagnostics, managed-identity telemetry, or Azure sensitive-resource inventories are disabled or incomplete

·        Google Cloud Admin Activity logs, Data Access logs, Cloud Identity logs, Cloud Storage logs, Secret Manager logs, Cloud KMS logs, Security Command Center context, Chronicle enrichment, service-account inventory, or sensitive-resource inventories are disabled or incomplete

·        Joomla-to-AWS, Joomla-to-Azure, or Joomla-to-Google Cloud workload, identity, source, host, resource, storage, secret, KMS, service-account, or correlation mapping is unreliable

·        Adversary activity blends into approved administrative, deployment, media-upload, plugin-update, template-update, backup, migration, hosting-provider, scanner, security-tooling, incident-response, or cleanup workflows

·        Downstream cloud activity does not occur after suspicious Joomla upload, webshell, credential-access, rare egress, CMS impact, FTP abuse, hosting-control abuse, or hosted-content impact context

·        Exploitation produces no observable upload anomaly, PHP-like web access, web server service-context behavior, sensitive-file access, rare egress, CMS state change, hosted-content impact, or downstream cloud activity

Traceability Conclusion

The S25 detection set provides broad behavior-led coverage across the key observable stages of suspicious Joomla extension upload or import activity, writable PHP placement, PHP-like web access, web server service-context execution, sensitive Joomla file access, database access, rare egress, CMS state changes, FTP activity, hosting-control activity, hosted-content impact, and downstream AWS, Azure, and Google Cloud activity.

Coverage is strongest for suspicious Joomla upload or import behavior, upload-to-PHP-access sequencing, writable-path PHP artifact access, web server service-context execution, sensitive-file access, database-tool activity, rare outbound communication, CMS administrator or Super User creation, plugin or template modification, redirect or mail-script modification, FTP or hosting-control abuse, hosted-content tampering, and downstream cloud activity when telemetry is normalized and sequence correlation is available.

The rule set intentionally avoids CVE-label-only matching, extension-name-only matching, exploit-name-only matching, static payload strings, single request paths, isolated source IPs, user-agent values, PHP function names, webshell strings, file hashes, scanner signatures, campaign names, actor branding, tool names, and other single-event conclusions as the basis for detection. Detection confidence depends on correlating suspicious Joomla upload activity, web-accessible PHP behavior, endpoint context, egress behavior, CMS impact, hosting-control activity, and downstream cloud behavior rather than treating any single event category as proof of compromise.

S27 Behavior & Log Artifacts

Purpose

This section identifies the primary behavior and log artifacts that support detection, investigation, triage, and validation for suspicious Joomla extension upload or import activity, writable-path PHP access, web server service-context execution, sensitive Joomla file access, database access, rare egress, CMS state change, FTP activity, hosting-control activity, hosted-content impact, and downstream cloud-impact activity.

The artifacts below are behavior-led. They should not be treated as proof of Joomla exploitation, PHP webshell execution, credential theft, database theft, CMS compromise, FTP compromise, hosting-control compromise, AWS compromise, Azure compromise, Google Cloud compromise, downstream cloud compromise, or data theft unless they are correlated into a coherent sequence.

Primary Artifact Categories

·        Joomla extension upload, profile-import, asset-upload, image-upload, media-upload, AJAX-upload, and request-handling artifacts

·        Joomla writable-path, extension-owned path, PHP-like artifact, webroot, file-integrity, and HTTP access artifacts

·        Web server service-context, process, command-line, sensitive-file, database-tool, transfer-tool, archive-tool, and endpoint artifacts

·        DNS, proxy, firewall, NDR, rare-destination, destination-reputation, first-seen, domain-age, ASN, geography, and egress artifacts

·        CMS state change, administrator creation, Super User creation, template modification, plugin modification, redirect modification, mail-script modification, cron modification, .htaccess modification, FTP, hosting-control, and hosted-content impact artifacts

·        Downstream AWS, Azure, and Google Cloud activity artifacts following suspicious Joomla upload, webshell, credential-access, egress, CMS, hosting-control, or hosted-content impact context

·        Joomla site, public asset, virtual host, backend host, workload, source, path, file, endpoint, process, destination, cloud-principal, and event-timestamp correlation artifacts

Joomla Extension Upload, Import, and Request-Handling Artifacts

Relevant Artifacts

Joomla site ID, public Joomla asset, virtual host, backend host, workload ID, HTTP method, request path, request query, full URL, source IP, forwarded source IP, source ASN, source geography, source network type, user agent, content type, request size, response size, HTTP status, request timing, request burst behavior, extension family, upload route, profile-import route, custom-icon upload route, asset upload route, image upload route, media upload route, AJAX upload route, JCE profile-import indicators, SP Page Builder upload indicators, Page Builder CK upload indicators, and event timestamp.

Useful Log Sources

·        Joomla web access logs

·        WAF logs

·        Reverse-proxy logs

·        CDN logs

·        Load-balancer logs

·        Web server logs

·        Firewall logs

·        DNS logs

·        Proxy logs

·        NDR / Network Behavioral Analytics telemetry

·        SIEM-normalized Joomla web telemetry

·        Joomla asset inventory

·        Joomla extension inventory

Detection Use

These artifacts support detection when suspicious Joomla extension upload, profile-import, custom-icon upload, asset upload, image upload, media upload, or AJAX upload behavior is joined with abnormal source context, abnormal request timing, suspicious content type, unusual request size, abnormal response size, abnormal status sequence, writable-path PHP access, endpoint service-context behavior, rare egress, CMS state change, FTP activity, hosting-control activity, hosted-content impact, or downstream cloud activity.

Investigation Use

Investigators should determine whether the upload or import behavior is expected for the Joomla site, extension, administrator, source IP, ASN, geography, user agent, route, content type, request size, timing pattern, maintenance state, deployment workflow, scanner activity, validation workflow, hosting-provider support activity, or business process. They should also review whether the activity is followed by PHP-like file access, web server service-context execution, sensitive-file access, rare egress, CMS state change, FTP activity, hosting-control activity, hosted-content impact, or downstream AWS, Azure, or Google Cloud activity.

Non-Coverage Conditions

A single POST request does not prove exploitation. A single extension upload route does not prove compromise. A single source IP, user-agent value, upload-sized request, status code, or extension name is not sufficient. These artifacts require correlation with same-site context, same-public-asset context, source context, writable-path lineage, uploaded-path lineage, endpoint behavior, egress behavior, CMS impact, hosting-control behavior, or downstream cloud activity before they become actionable as compromise-oriented detection evidence.

Writable PHP Web Access and Webroot Artifact Activity

Relevant Artifacts

Writable path, extension-owned path, media path, image path, upload path, tmp path, cache path, asset path, iconfont path, gfonts path, template path, plugin path, component path, module path, PHP-like file path, PHP-like file name, uploaded path, writable path family, extension family, HTTP GET or POST access, HTTP status code, response size, response-size delta, request timing, webshell-like timing pattern, rare or automated user agent, file creation, file modification, file rename, file write, file-integrity event, and event timestamp.

Useful Log Sources

·        Joomla web access logs

·        Web server logs

·        WAF logs

·        Reverse-proxy logs

·        CDN logs

·        Load-balancer logs

·        Linux audit logs

·        File-integrity monitoring logs

·        EDR telemetry

·        SentinelOne endpoint telemetry

·        SIEM-normalized web and file telemetry

Detection Use

These artifacts support detection when PHP-like file access or file activity in Joomla writable, media, upload, tmp, cache, template, plugin, component, module, or extension-owned paths occurs after suspicious upload or import behavior. They are strongest when tied to prior extension upload context, same-site continuity, source continuity, writable-path lineage, uploaded-path lineage, backend-host lineage, endpoint context, or downstream impact.

Investigation Use

Investigators should determine whether PHP-like artifacts in writable or extension-owned paths are expected for the Joomla site, extension, template, plugin, media workflow, deployment workflow, backup job, restore activity, scanner validation, hosting-provider support action, incident-response cleanup, or emergency remediation. They should review whether the file was created, modified, renamed, accessed over HTTP, executed indirectly, or followed by endpoint, egress, CMS, FTP, hosting-control, or cloud activity.

Non-Coverage Conditions

PHP-like file access alone is not sufficient. A writable path alone is not sufficient. A PHP-like filename alone is not sufficient. A successful HTTP response alone is not sufficient. These artifacts require correlation with prior suspicious upload activity, same-site context, source continuity, writable-path lineage, endpoint service-context behavior, rare egress, CMS impact, or downstream cloud activity.

Web Server Service-Context and Endpoint Artifacts

Relevant Artifacts

Process name, parent process name, process user, web server service user, PHP runtime process, command line, shell interpreter use, scripting interpreter use, transfer-tool use, archive-tool use, network-tool use, database-tool use, encoding or obfuscation tool use, sensitive-file access, file path, file name, file action, process start time, process tree, destination domain, destination IP, destination port, host name, endpoint ID, workload ID, and event timestamp.

Useful Log Sources

·        SentinelOne endpoint telemetry

·        EDR telemetry

·        Linux audit logs

·        File-integrity monitoring logs

·        Web server host logs

·        Process telemetry

·        DNS logs

·        Proxy logs

·        Firewall logs

·        SIEM-normalized endpoint telemetry

Detection Use

These artifacts support detection when suspicious endpoint or process activity occurs in web server service context after suspicious Joomla upload activity, writable PHP access, or webshell-like behavior. They are useful for identifying command execution, file manipulation, database access, archive creation, transfer activity, credential-file access, and outbound callback behavior.

Investigation Use

Investigators should determine whether process, command-line, file, and network behavior is expected for the Joomla host, web server service account, PHP runtime, extension update process, backup workflow, migration workflow, hosting-provider support activity, security tooling, incident-response cleanup, or deployment workflow. They should review whether the activity follows suspicious upload behavior and whether it touches sensitive files, databases, outbound destinations, CMS state, or cloud resources.

Non-Coverage Conditions

Endpoint process activity alone is not sufficient. Web server user context alone is not sufficient. A shell, scripting interpreter, transfer tool, archive tool, database tool, or network tool alone is not sufficient. Sensitive-file access alone is not sufficient. These artifacts require prior suspicious Joomla upload activity, writable PHP access, same-host lineage, same-site lineage, web server service context, or downstream impact context.

Sensitive Joomla File, Credential, and Database Artifacts

Relevant Artifacts

Joomla configuration.php access, credential-file access, sensitive Joomla file path, file open, file read, file copy, file archive, file modification, database-tool execution, database dump command, database connection activity, archive creation, compressed file creation, credential-access command pattern, discovery command pattern, web server service user, process name, command line, file path, file action, and event timestamp.

Useful Log Sources

·        SentinelOne endpoint telemetry

·        EDR telemetry

·        Linux audit logs

·        File-integrity logs

·        Database host logs where available

·        Web server host logs

·        SIEM-normalized endpoint and database telemetry

·        Backup and administrative workflow records

Detection Use

These artifacts support detection when sensitive Joomla files, credential material, or database tooling are accessed after suspicious Joomla upload behavior, writable PHP access, or web server service-context execution. They are especially useful for triaging likely credential theft, configuration exposure, database staging, and post-upload impact.

Investigation Use

Investigators should determine whether sensitive-file or database access is expected for the Joomla site, administrator, service account, backup job, restore process, migration workflow, hosting-provider support activity, incident-response collection, or security tooling. They should review whether access occurred in web server context and whether activity was followed by rare egress, archive creation, CMS state change, hosted-content impact, or downstream cloud activity.

Non-Coverage Conditions

Access to configuration.php alone is not sufficient. Database-tool execution alone is not sufficient. Archive activity alone is not sufficient. Credential-access command text alone is not sufficient. These artifacts require prior suspicious Joomla upload activity, writable PHP access, webshell execution context, same-host lineage, same-site lineage, service-context linkage, or downstream impact context.

Rare Egress and Suspicious Destination Artifacts

Relevant Artifacts

Destination domain, destination IP, destination port, destination reputation, destination first-seen status, destination domain age, destination ASN, destination geography, proxy action, firewall action, DNS query, NDR flow, source host, source IP, endpoint ID, workload ID, Joomla site ID, destination baseline, egress baseline, and event timestamp.

Useful Log Sources

·        DNS logs

·        Proxy logs

·        Firewall logs

·        NDR / Network Behavioral Analytics telemetry

·        EDR network telemetry

·        SentinelOne telemetry

·        VPC or cloud flow logs where applicable

·        SIEM-normalized egress telemetry

Detection Use

These artifacts support detection when rare or suspicious outbound communication occurs after suspicious Joomla upload activity, writable PHP access, web server service-context execution, sensitive-file access, or CMS impact. They are useful for identifying callback behavior, staging activity, command-and-control-like behavior, credential exfiltration paths, and hosted-content abuse infrastructure.

Investigation Use

Investigators should determine whether the destination is expected for Joomla updates, CDN services, monitoring, backup, hosting-provider workflows, security tooling, vulnerability validation, incident-response activity, or approved business processes. They should review destination age, reputation, ASN, geography, port, proxy action, firewall action, timing, and host lineage.

Non-Coverage Conditions

Rare egress alone is not sufficient. A suspicious destination alone is not sufficient. Destination reputation alone is not sufficient. New domain age alone is not sufficient. Unusual destination port alone is not sufficient. These artifacts require prior suspicious Joomla upload behavior, writable PHP access, endpoint service-context behavior, same-site lineage, same-host lineage, or downstream impact context.

CMS State, FTP, Hosting-Control, and Hosted-Content Impact Artifacts

Relevant Artifacts

Administrator creation, Super User creation, CMS user change, template modification, plugin modification, component modification, redirect modification, mail-script modification, cron modification, .htaccess modification, Joomla configuration change, FTP login, FTP upload, FTP download, hosting-control panel login, hosting-control file-manager upload, domain redirect change, mail setting change, scheduled task change, hosted-content tampering, phishing hosting, malware hosting, spam infrastructure, webroot change, source IP, user identity, hosting account, and event timestamp.

Useful Log Sources

·        Joomla administrative logs where available

·        CMS state telemetry

·        Webroot file-integrity logs

·        FTP logs

·        Hosting-control panel logs

·        WAF logs

·        CDN logs

·        DNS logs

·        Proxy logs

·        Web content monitoring

·        SIEM-normalized CMS and hosting telemetry

Detection Use

These artifacts support detection when CMS state changes, FTP activity, hosting-control activity, or hosted-content impact occurs after suspicious Joomla upload activity, writable PHP access, web server service-context execution, sensitive-file access, or rare egress. They are useful for identifying persistence, defacement, phishing hosting, malware hosting, spam infrastructure, content tampering, redirect abuse, and hosting-account compromise.

Investigation Use

Investigators should determine whether CMS, FTP, hosting-control, or hosted-content activity is expected for the administrator, hosting provider, deployment workflow, content update, SEO workflow, backup job, restore activity, migration workflow, incident-response cleanup, or emergency remediation. They should review whether activity follows suspicious upload or webshell context and whether it involves unauthorized users, templates, plugins, redirects, mail scripts, cron jobs, .htaccess, or hosted-content changes.

Non-Coverage Conditions

CMS state change alone is not sufficient. FTP activity alone is not sufficient. Hosting-control activity alone is not sufficient. Hosted-content change alone is not sufficient. Administrator creation alone is not sufficient. These artifacts require prior suspicious upload activity, writable PHP access, webshell execution context, source continuity, site continuity, host continuity, or hosting-control lineage.

Downstream AWS Cloud Artifacts

Relevant Artifacts

CloudTrail management event, CloudTrail data event, IAM Identity Center activity, role assumption, IAM policy change, access-key creation, access-key use, Secrets Manager access, KMS activity, S3 access, S3 enumeration, CloudTrail modification, CloudWatch logging change, GuardDuty finding, Security Hub finding, AWS Config change, Organizations activity, compute change, network exposure change, snapshot export, image export, principal ARN, role ARN, account ID, resource ID, resource ARN, region, source IP, user agent, event name, and event timestamp.

Useful Log Sources

·        AWS CloudTrail management events

·        AWS CloudTrail data events

·        IAM Identity Center logs

·        GuardDuty

·        Security Hub

·        AWS Config

·        AWS Organizations logs

·        VPC Flow Logs where useful

·        Route 53 Resolver logs where useful

·        S3 access logs where applicable

·        SIEM-normalized AWS telemetry

·        SIEM-forwarded Joomla context

Detection Use

These artifacts support downstream AWS cloud-impact detection only when prior suspicious Joomla upload, writable PHP access, webshell execution, credential-file access, rare egress, CMS impact, FTP abuse, hosting-control abuse, or hosted-content impact context is present and AWS activity is objectively suspicious.

Investigation Use

Investigators should determine whether AWS activity aligns to the same AWS account, workload, host, source IP, assumed role, instance, container, resource, S3 bucket, secret, KMS key, or equivalent normalized cloud lineage tied to the Joomla context. They should also review whether activity involves high-risk events, access-key novelty, sensitive resources, secrets access, KMS activity, S3 activity, logging changes, security-control modification, or administrative changes.

Non-Coverage Conditions

AWS activity alone is not sufficient. AWS console access alone is not sufficient. IAM activity alone is not sufficient. Role assumption alone is not sufficient. Secrets Manager, KMS, or S3 access alone is not sufficient. Cloud-only anomalies must not be attributed to Joomla exploitation or webshell execution unless reliable upstream Joomla context and workload or identity-lineage correlation exist.

Downstream Azure Cloud Artifacts

Relevant Artifacts

Azure Activity event, Entra ID sign-in activity, Entra ID audit activity, Azure Resource Manager activity, role assignment, service-principal activity, managed-identity activity, Key Vault access, Storage access, Defender for Cloud alert, Sentinel incident, Azure Policy change, diagnostic-setting change, logging change, network security change, App Service activity, VM activity, container workload activity, tenant ID, subscription ID, resource ID, application ID, service principal ID, managed identity ID, source IP, user agent, correlation ID, and event timestamp.

Useful Log Sources

·        Azure Activity logs

·        Entra ID sign-in logs

·        Entra ID audit logs

·        Azure Resource Manager activity

·        Azure Key Vault logs

·        Azure Storage logs

·        Defender for Cloud

·        Microsoft Sentinel

·        Azure Policy logs

·        Azure diagnostic-setting logs

·        Azure Firewall or NSG flow logs where useful

·        SIEM-normalized Azure telemetry

·        SIEM-forwarded Joomla context

Detection Use

These artifacts support downstream Azure cloud-impact detection only when prior suspicious Joomla upload, writable PHP access, webshell execution, credential-file access, rare egress, CMS impact, FTP abuse, hosting-control abuse, or hosted-content impact context is present and Azure activity is objectively suspicious.

Investigation Use

Investigators should determine whether Azure activity aligns to the same tenant, subscription, resource, VM, App Service, container workload, application, service principal, managed identity, source IP, Storage account, Key Vault, correlation ID, or equivalent normalized cloud lineage tied to the Joomla context. They should also review whether activity involves role changes, Key Vault access, Storage access, diagnostic logging changes, security-control changes, policy changes, service-principal changes, managed-identity activity, Defender alerts, or Sentinel incidents.

Non-Coverage Conditions

Azure activity alone is not sufficient. Azure portal access alone is not sufficient. Entra ID sign-in activity alone is not sufficient. Role assignment alone is not sufficient. Key Vault access alone is not sufficient. Storage access alone is not sufficient. Cloud-only anomalies must not be attributed to Joomla exploitation or webshell execution unless reliable upstream Joomla context and workload or identity-lineage correlation exist.

Downstream GCP Cloud Artifacts

Relevant Artifacts

Google Cloud Admin Activity, Data Access activity, IAM policy change, role binding, service-account key creation, service-account impersonation, service-account use, workload identity federation activity, workforce identity federation activity, Cloud Storage access, Secret Manager access, Cloud KMS activity, logging sink modification, monitoring change, audit logging modification, Security Command Center finding, Security Command Center suppression, firewall rule change, public exposure change, project administration, organization administration, principal email, Google account ID, service account ID, workload identity subject, organization ID, project ID, resource name, method name, source IP, user agent, and event timestamp.

Useful Log Sources

·        Google Cloud Admin Activity audit logs

·        Google Cloud Data Access audit logs

·        Google Cloud IAM logs

·        Google Cloud service-account logs

·        Cloud Storage logs

·        Secret Manager logs

·        Cloud KMS logs

·        Cloud Identity logs

·        Security Command Center

·        Cloud Logging

·        Chronicle or SIEM-normalized Google Cloud telemetry

·        SIEM-forwarded Joomla context

Detection Use

These artifacts support downstream Google Cloud-impact detection only when prior suspicious Joomla upload, writable PHP access, webshell execution, credential-file access, rare egress, CMS impact, FTP abuse, hosting-control abuse, or hosted-content impact context is present and Google Cloud activity is objectively suspicious.

Investigation Use

Investigators should determine whether Google Cloud activity aligns to the same organization, project, resource, Compute instance, GKE cluster, Cloud Run service, App Engine service, service account, workload identity, source IP, Cloud Storage bucket, Secret Manager secret, KMS key, correlation ID, or equivalent normalized cloud lineage tied to the Joomla context. They should also review whether activity involves IAM changes, service-account credential novelty, Cloud Storage access, Secret Manager access, Cloud KMS activity, logging changes, Security Command Center findings, project administration, or organization administration.

Non-Coverage Conditions

Google Cloud activity alone is not sufficient. Google Cloud console access alone is not sufficient. Service-account activity alone is not sufficient. Cloud Storage, Secret Manager, or Cloud KMS access alone is not sufficient. Cloud-only anomalies must not be attributed to Joomla exploitation or webshell execution unless reliable upstream Joomla context and workload or identity-lineage correlation exist.

YARA Artifact Disposition

YARA has no deployable primary-rule artifact set for this EXP report.

YARA is not viable as a primary artifact model because the report’s detection surface is behavioral, sequence-based, web-telemetry driven, SIEM-correlation based, endpoint-context based, egress-correlation based, CMS-impact based, hosting-control-context based, and downstream cloud-correlation based rather than static-file, malware-signature, or artifact-matching based.

YARA may become useful only if a confirmed malicious PHP artifact, webshell body, encoded payload, loader, dropper, script artifact, archive artifact, memory artifact, configuration implant, or reusable malware family artifact is recovered and independently validated.

Final YARA Outcome

No YARA rules survive.

S28 Detection Strategy and SOC Implementation Guidance

Figure 5

Purpose

This section provides implementation guidance for operationalizing the S25 rule set and S26 traceability model across Joomla web telemetry, NDR / Network Behavioral Analytics, SentinelOne, Splunk, Elastic, QRadar, SIGMA, YARA, AWS, Azure, GCP, WAF, reverse-proxy, CDN, load-balancer, endpoint, EDR, Linux audit, file-integrity, CMS, FTP, hosting-control, SIEM, SOAR, and incident-response environments.

The detection strategy is sequence-based. It prioritizes correlated behavior over single-event alerting and avoids treating a single CVE label, extension name, exploit name, request path, source IP, user agent, upload request, PHP filename, status code, webshell string, file hash, PHP function, rare destination, CMS change, cloud event, or static indicator as proof of compromise.

Implementation Strategy

Deploy the detection model in layered stages:

·        Joomla public asset, site ID, virtual host, backend host, workload, extension inventory, and exposure context first

·        Joomla extension upload route, profile-import route, custom-icon upload route, asset upload route, image upload route, media upload route, AJAX upload route, request, source, timing, content type, status, request-size, and response-size context second

·        Writable path, extension-owned path, uploaded path, PHP-like artifact, webroot, file-integrity, and HTTP access context third

·        Endpoint service-context, process, command-line, sensitive-file, database-tool, transfer-tool, archive-tool, and file-action correlation fourth

·        DNS, proxy, firewall, NDR, destination reputation, first-seen, domain-age, ASN, geography, destination-port, and egress correlation fifth

·        CMS state change, FTP activity, hosting-control activity, hosted-content impact, phishing-hosting, malware-hosting, and spam-infrastructure context sixth

·        Downstream AWS, Azure, and Google Cloud cloud-impact correlation seventh

·        Alert promotion only after local telemetry validation, false-positive baselining, suppression governance, and triage playbook alignment

Telemetry Normalization Requirements

Implementation requires normalized entity and time correlation across Joomla web, WAF, reverse-proxy, CDN, load-balancer, web server, endpoint, EDR, Linux audit, file-integrity, DNS, proxy, firewall, NDR, CMS, FTP, hosting-control, AWS, Azure, Google Cloud, SOAR, incident-response, and SIEM telemetry.

Minimum Normalization Requirements

·        Joomla site ID

·        Public Joomla asset

·        Virtual host

·        Backend host

·        Workload ID

·        Hosting provider or platform context where applicable

·        Joomla extension inventory

·        Extension family

·        Upload route

·        Writable path family

·        Uploaded path

·        PHP-like artifact path

·        Request path

·        Request query

·        Full URL

·        HTTP method

·        Source IP

·        Forwarded source IP

·        ASN

·        Geography

·        Source network type

·        User agent

·        Content type

·        Request size

·        Response size

·        HTTP status code

·        Request timing

·        Status sequence

·        File path

·        File name

·        File event action

·        Process user

·        Parent process name

·        Process name

·        Command line

·        Web server service user indicator

·        PHP runtime indicator

·        Sensitive Joomla file indicator

·        Database-tool indicator

·        Archive-tool indicator

·        Transfer-tool indicator

·        DNS query

·        Destination domain

·        Destination IP

·        Destination port

·        Destination reputation

·        Destination first-seen status

·        Destination domain age

·        Destination ASN

·        Destination geography

·        Proxy action

·        Firewall action

·        CMS state change

·        FTP activity

·        Hosting-control activity

·        Hosted-content impact

·        AWS account, role, principal, region, and resource

·        Azure tenant, subscription, application, service principal, managed identity, and resource

·        GCP organization, project, principal, service account, and resource

·        SOAR case ID

·        Incident-response case ID

·        Event timestamp

·        Event source

·        Approved workflow context

Correlation Requirements

Rules should use bounded correlation windows that reflect the relationship between suspicious Joomla upload activity and follow-on PHP access, endpoint behavior, egress behavior, CMS impact, hosting-control activity, or cloud behavior.

Recommended Starting Windows

·        Suspicious Joomla extension upload or import activity to writable PHP web access within 30 minutes

·        Suspicious Joomla extension upload or import activity to endpoint service-context behavior within 2 hours

·        Suspicious Joomla extension upload or import activity to sensitive-file access, database access, archive activity, or transfer-tool use within 4 hours

·        Suspicious Joomla extension upload or import activity to rare egress or suspicious destination activity within 4 hours

·        Suspicious Joomla extension upload or import activity to CMS state change, FTP activity, hosting-control activity, or hosted-content impact within 8 hours

·        Suspicious Joomla upload, webshell, credential-access, rare-egress, CMS-impact, FTP-abuse, hosting-control-abuse, or hosted-content-impact context to AWS, Azure, or Google Cloud activity within 24 hours

·        Continued writable PHP access, endpoint service-context behavior, egress, CMS change, hosting-control activity, or cloud activity after incident-response containment or administrative remediation within 24 hours

These windows should be tightened in high-volume environments and extended only when source continuity, uploaded-path lineage, writable-path lineage, endpoint evidence, web server service-context evidence, egress evidence, CMS state evidence, hosting-control evidence, SOAR evidence, or incident-response evidence supports continuity.

Alert Promotion Guidance

Do not promote a hunt or correlation search into alert mode until the following conditions are met:

·        Required telemetry is present and normalized

·        Required field mappings are validated

·        Joomla site and public-asset tagging are reliable

·        Virtual-host and backend-host mapping is reliable

·        Extension inventory and upload-route mapping are reliable

·        Writable-path and PHP-like artifact mapping are reliable

·        Entity resolution is reliable

·        Event timing and ordering are reliable

·        Web, WAF, reverse-proxy, CDN, load-balancer, endpoint, file, process, DNS, proxy, firewall, CMS, FTP, hosting-control, and cloud context are mapped

·        Approved workflow baselines are defined

·        False-positive sources are reviewed

·        High-volume expected workflows are suppressed or downgraded

·        Query performance is tested

·        Triage guidance is documented

·        Analyst review criteria are established

·        Local severity logic is calibrated

·        Alert-routing ownership is assigned

False-Positive Control

False-positive control should use allowlists, reference sets, approved workflow baselines, known source IP ranges, approved Joomla administrators, approved scanner sources, approved hosting-provider support sources, approved validation sources, approved deployment sources, approved backup workflows, approved migration workflows, approved maintenance windows, approved cleanup windows, approved file paths, approved process baselines, approved command patterns, approved egress destinations, expected extension update workflows, expected media upload workflows, expected template maintenance, expected plugin maintenance, approved service accounts, approved cloud automation identities, and known incident-response workflows.

Common False-Positive Sources

·        Approved Joomla administration

·        Approved extension updates

·        Approved plugin updates

·        Approved template changes

·        Approved media uploads

·        Approved content workflows

·        Approved deployment activity

·        Approved scanner activity

·        Approved vulnerability validation

·        Approved penetration testing

·        Approved hosting-provider support activity

·        Approved malware cleanup

·        Approved emergency remediation

·        Approved backup jobs

·        Approved restore jobs

·        Approved migration workflows

·        Approved file-integrity validation

·        Approved webroot inspection

·        Approved security tooling

·        Approved incident-response collection

·        Approved monitoring activity

·        Approved CDN or WAF validation

·        Approved DNS validation

·        Approved FTP activity

·        Approved hosting-control panel use

·        Approved cloud automation

·        Infrastructure-as-code workflows

·        CI/CD workflows

·        Break-glass activity

·        Managed-service activity

·        CDN, monitoring, backup, hosting-provider, or business update destinations

Triage Guidance

Initial triage should determine whether suspicious activity forms a coherent sequence rather than a single-event anomaly.

Triage Questions

·        Was suspicious Joomla extension upload, profile-import, custom-icon upload, asset upload, image upload, media upload, or AJAX upload activity observed

·        Was the affected site a public Joomla asset

·        Was the source IP, ASN, geography, user agent, source network type, HTTP method, content type, request volume, request timing, request size, response size, or status sequence unusual

·        Was the activity tied to JCE profile import, SP Page Builder upload behavior, Page Builder CK upload behavior, a generic media upload route, an AJAX upload route, or another extension-owned upload path

·        Was PHP-like access observed in a Joomla writable, media, image, upload, tmp, cache, template, plugin, component, module, or extension-owned webroot path

·        Did endpoint service-context behavior occur on the Joomla host after suspicious upload or PHP access

·        Did web server service context spawn shell, scripting, transfer, archive, network, database, encoding, or obfuscation tools

·        Was sensitive Joomla file access, credential-file access, database access, database dump behavior, archive activity, or transfer-tool use observed

·        Did rare outbound communication, suspicious destination access, new-domain access, unusual egress port, suspicious ASN, or abnormal destination geography occur

·        Did CMS administrator creation, Super User creation, template modification, plugin modification, redirect modification, mail-script modification, cron modification, .htaccess modification, FTP activity, hosting-control activity, or hosted-content impact occur

·        Did downstream AWS, Azure, or Google Cloud administrative or sensitive-resource activity follow

·        Can the activity be linked by Joomla site, public asset, virtual host, backend host, workload, source IP, uploaded path, writable path, endpoint ID, process context, destination, CMS account, hosting-control account, cloud principal, SOAR case, incident-response case, or equivalent normalized lineage

·        Is the activity explained by approved administration, extension update, media upload, deployment, scanner validation, hosting-provider support, backup, migration, maintenance, malware cleanup, emergency remediation, security tooling, automation, or known business workflow

Escalation Guidance

Escalate when multiple behavior classes align in sequence, especially when suspicious Joomla extension upload or import activity is followed by writable PHP access, web server service-context execution, sensitive-file access, database access, rare egress, CMS state change, FTP activity, hosting-control activity, hosted-content impact, or downstream cloud administrative behavior.

Higher-Priority Escalation Conditions

·        The affected Joomla site is internet-facing

·        The affected Joomla site hosts sensitive customer, payment, account, regulated, legal, executive, operational, or production content

·        The affected Joomla site has administrative access to hosting workflows, storage, cloud resources, or customer data

·        Suspicious upload behavior and writable PHP web access align

·        Suspicious upload behavior and web server service-context execution align

·        Suspicious upload behavior and sensitive Joomla file access align

·        Suspicious upload behavior and rare egress align

·        Suspicious upload behavior and CMS administrator or Super User creation align

·        Suspicious upload behavior and template, plugin, redirect, mail-script, cron, or .htaccess modification align

·        FTP activity or hosting-control activity follows suspicious upload behavior

·        Hosted-content tampering, phishing hosting, malware hosting, or spam infrastructure appears after suspicious upload behavior

·        AWS, Azure, or Google Cloud activity involves privileged roles, service accounts, secrets, keys, storage, logging changes, security-control suppression, or administrative configuration

·        Multiple systems independently show aligned behavior

Deployment Guardrails

Do not deploy these detections as fully automated blocking or containment logic without local validation.

Do not treat a single CVE label, extension name, exploit name, upload route, POST request, source IP, user agent, content type, PHP-like file path, HTTP status code, webshell string, PHP function, file hash, destination, CMS change, cloud event, or static indicator as proof of compromise.

Do not attribute cloud-only, endpoint-only, egress-only, web-only, CMS-only, FTP-only, hosting-control-only, or content-only anomalies to Joomla exploitation, webshell execution, credential theft, CMS compromise, hosting compromise, or downstream cloud compromise without prior suspicious Joomla context and reliable workload, source, host, site, identity, or resource-lineage correlation.

Do not enable high-confidence alerting until platform-specific schemas, index names, sourcetypes, DSM fields, custom properties, ECS mappings, Joomla fields, WAF fields, CloudTrail fields, Azure fields, Google Cloud audit fields, endpoint mappings, file mappings, process mappings, source mappings, site mappings, workload mappings, cloud identity mappings, enrichment sources, exception lists, false-positive baselines, query performance, triage readiness, and escalation criteria have been validated.

S29 Detection Coverage Summary

Coverage Summary

The S25 detection set provides broad behavior-led coverage for suspicious Joomla extension upload or import activity, writable-path PHP access, PHP-like web artifact access, web server service-context execution, sensitive Joomla file access, database access, rare egress, CMS state change, FTP activity, hosting-control activity, hosted-content impact, and downstream cloud-impact activity.

Coverage is strongest when Joomla web, WAF, reverse-proxy, CDN, load-balancer, endpoint, EDR, Linux audit, file-integrity, DNS, proxy, firewall, NDR, CMS, FTP, hosting-control, AWS, Azure, Google Cloud, and SIEM telemetry are normalized and correlated into bounded sequences.

The report’s detection model intentionally avoids CVE-label-only matching, extension-name-only matching, exploit-name-only matching, static payload strings, single request paths, isolated source IPs, user-agent values, PHP function names, webshell strings, file hashes, scanner signatures, campaign names, actor branding, tool names, cloud events alone, and single-event conclusions. It focuses on durable activity patterns that remain useful across Joomla extension upload abuse, upload-path enablement, PHP-like artifact placement, webshell execution behavior, CMS impact, hosting abuse, and downstream cloud activity.

Strong Coverage Areas

·        Suspicious Joomla extension upload, profile-import, custom-icon upload, asset upload, image upload, media upload, AJAX upload, and request-handling behavior

·        JCE profile-import behavior when correlated with Joomla site context, approved-source exclusions, and follow-on behavior

·        SP Page Builder upload behavior when correlated with Joomla site context, approved-source exclusions, and follow-on behavior

·        Page Builder CK upload behavior when correlated with Joomla site context, approved-source exclusions, and follow-on behavior

·        Writable-path PHP access and PHP-like web artifact access after suspicious upload activity

·        Web server service-context execution, shell or scripting interpreter use, transfer-tool use, archive-tool use, database-tool use, and suspicious command execution after suspicious upload activity

·        Sensitive Joomla file access, credential-file access, database access, database dump behavior, and archive activity after suspicious upload or webshell context

·        Rare outbound communication, suspicious destination access, new or rare domain access, unusual egress port, suspicious ASN, suspicious destination geography, or suspicious destination reputation after suspicious upload behavior

·        CMS administrator or Super User creation, plugin modification, template modification, redirect modification, mail-script modification, cron modification, .htaccess modification, FTP activity, hosting-control activity, hosted-content tampering, phishing hosting, malware hosting, and spam infrastructure after suspicious upload behavior

·        Downstream AWS, Azure, and Google Cloud activity when correlated with suspicious Joomla upload, webshell, credential-access, rare-egress, CMS-impact, FTP-abuse, hosting-control-abuse, or hosted-content-impact context

Moderate Coverage Areas

·        Suspicious Joomla upload activity where web logs are partial or field mappings vary

·        Extension-route detection where query strings, URI paths, or content-type fields are incomplete

·        Writable PHP artifact coverage where file-integrity or uploaded-path lineage is incomplete

·        Endpoint service-context coverage where EDR telemetry exists but process lineage, command-line capture, or file telemetry is partial

·        NDR visibility into upload, PHP access, and rare egress behavior without endpoint or CMS enrichment

·        Sensitive-file and database access coverage where Linux audit or file telemetry is incomplete

·        CMS state and hosting-control detection where administrative logs are inconsistent

·        SIGMA portability across SIEM backends

·        Cloud detection where Joomla-to-cloud workload, identity, host, source, storage, secret, KMS, service-account, or resource lineage is partial

·        Hosted-content impact detection where CDN, WAF, DNS, webroot, or content-monitoring telemetry is incomplete

Limited Coverage Areas

·        Exploitation that produces no observable upload anomaly, PHP-like web access, endpoint activity, egress, CMS change, hosting-control behavior, hosted-content impact, or cloud activity

·        PHP webshell execution that blends into normal administrative, deployment, maintenance, cleanup, or hosting-provider workflows

·        Credential theft that does not produce sensitive-file access, database access, egress, cloud activity, or CMS impact

·        Database theft that occurs through expected backup, migration, or administrative workflows without anomalous timing or context

·        CMS compromise that uses approved administrator accounts, expected source IPs, expected devices, and normal content workflows

·        Rare egress that uses approved CDN, backup, monitoring, hosting-provider, or business destinations

·        Hosted-content tampering that mirrors approved deployment or content-management workflows

·        Cloud activity without reliable Joomla-to-AWS, Joomla-to-Azure, or Joomla-to-Google Cloud workload, identity, source, host, resource, storage, secret, KMS, service-account, or correlation linkage

·        Environments without CloudTrail data events, Azure Key Vault logs, Azure Storage logs, Google Cloud Data Access logs, Cloud Storage logs, Secret Manager logs, Cloud KMS logs, or equivalent sensitive-service visibility

Non-Covered Areas

The S25 rule set does not directly prove:

·        Joomla exploitation

·        PHP webshell execution

·        Credential theft

·        Database theft

·        CMS compromise

·        FTP compromise

·        Hosting-control compromise

·        Hosted-content compromise

·        Data theft

·        AWS compromise

·        Azure compromise

·        Google Cloud compromise

·        Downstream cloud compromise

·        Adversary attribution

·        Campaign attribution

These outcomes require investigation, corroborating telemetry, and incident-specific validation.

System Coverage Summary

NDR / Network Behavioral Analytics

NDR provides primary network-behavior and supporting sequence coverage for suspicious Joomla extension upload routes, rare source infrastructure, abnormal request timing, abnormal request size, abnormal response size, unusual status sequences, upload-to-PHP-access behavior, rare destination access, suspicious destination reputation, new or rare domains, unusual egress ports, proxy anomalies, firewall anomalies, hosted-content behavior, and cloud access paths.

NDR does not independently prove Joomla exploitation, PHP webshell execution, credential theft, database theft, CMS compromise, cloud compromise, or data theft without web, endpoint, CMS, hosting-control, cloud, or SIEM-forwarded context.

SentinelOne

SentinelOne provides strong supporting endpoint coverage where Joomla host, web server service-context, PHP runtime, process, command-line, file, sensitive-file, transfer-tool, archive-tool, database-tool, network, and rare-egress context can be joined to suspicious Joomla upload, writable PHP access, or webshell-like telemetry.

SentinelOne is strongest as host-side behavior context rather than as the primary source of Joomla exploitation proof.

Splunk

Splunk provides strong correlation coverage when Joomla web, WAF, reverse-proxy, CDN, load-balancer, endpoint, file, process, DNS, proxy, firewall, CMS, FTP, hosting-control, AWS, Azure, and Google Cloud telemetry are normalized into searchable indexes with reliable field mappings, sourcetypes, lookups, summary datasets, and sequence logic.

Elastic

Elastic provides strong SIEM sequence and correlation coverage when Joomla web, WAF, reverse-proxy, CDN, load-balancer, endpoint, file, process, DNS, proxy, firewall, CMS, FTP, hosting-control, AWS, Azure, and Google Cloud data are normalized into ECS-compatible or locally enriched fields with reliable EQL sequencing, transforms, enrichments, value lists, and exception handling.

QRadar

QRadar provides strong correlation coverage when DSM parsing, custom properties, reference sets, reference maps, building blocks, event ordering, and offense grouping are validated across Joomla web, WAF, reverse-proxy, CDN, load-balancer, endpoint, file, process, DNS, proxy, firewall, CMS, FTP, hosting-control, AWS, Azure, and Google Cloud telemetry.

SIGMA

SIGMA provides portable event-rule template logic for suspicious Joomla extension upload context, writable PHP access, endpoint or egress impact, CMS state change, FTP activity, hosting-control activity, hosted-content impact, and downstream cloud activity.

SIGMA production value depends on SIEM translation quality, field mappings, enrichment-field creation, sequence support, wildcard behavior, case handling, backend-native correlation, and local event-source coverage.

YARA

YARA has zero deployable rules for this EXP report because no stable malicious PHP artifact, webshell body, payload family, dropper, loader, script artifact, archive artifact, memory artifact, configuration implant, or reusable malware family is available.

AWS

AWS provides conditional downstream cloud-impact coverage when suspicious AWS activity is correlated with prior Joomla upload, webshell, credential-access, rare-egress, CMS-impact, FTP-abuse, hosting-control-abuse, or hosted-content-impact context through reliable AWS account lineage plus stronger workload, identity, source, host, resource, S3, Secrets Manager, KMS, assumed-role, instance, container, workload, or correlation linkage.

Azure

Azure provides conditional downstream cloud-impact coverage when suspicious Azure control-plane, identity, resource, Key Vault, Storage, service-principal, managed-identity, diagnostic, logging, security, or administrative activity is correlated with prior Joomla context through reliable tenant and subscription lineage plus stronger workload, identity, source, host, resource, Storage, Key Vault, service-principal, managed-identity, application, or correlation-ID linkage.

GCP

GCP provides conditional downstream Google Cloud coverage when Google Cloud audit logs, Data Access logs, IAM logs, service-account logs, Cloud Storage logs, Secret Manager logs, KMS logs, Security Command Center context, Chronicle context, and Joomla context are normalized and correlated through organization and project lineage plus stronger workload, identity, source, host, resource, Cloud Storage, Secret Manager, KMS, service-account, workload-identity, or correlation-ID linkage.

Coverage Conclusion

The detection set provides strong practical coverage for observable enterprise behavior associated with suspicious Joomla extension upload or import activity, writable PHP artifact placement or access, web server service-context execution, sensitive Joomla file access, database access, rare egress, CMS impact, FTP activity, hosting-control activity, hosted-content impact, and downstream cloud activity.

It is strongest when multiple telemetry classes align in sequence and weakest where exploitation produces no observable upload anomaly, PHP-like web access, endpoint service-context behavior, sensitive-file access, rare egress, CMS state change, hosted-content impact, hosting-control activity, or downstream cloud behavior.

S30 Intelligence Maturity Assessment

Maturity Assessment Summary

The intelligence maturity level for this report is high for behavior-led detection strategy and moderate for direct compromise confirmation.

The detection model is mature because it focuses on durable behavioral relationships: suspicious Joomla extension upload or import activity, writable-path PHP access, web server service-context execution, sensitive Joomla file access, database access, rare egress, CMS state change, FTP activity, hosting-control activity, hosted-content impact, and downstream cloud activity.

Direct compromise confirmation remains limited because enterprise telemetry generally does not expose attacker intent, exploit success, PHP webshell control, credential theft, database theft, CMS compromise, hosting-control compromise, or downstream cloud compromise directly. Most environments infer misuse through suspicious upload behavior, PHP-like web access, endpoint service-context behavior, sensitive-file access, rare egress, CMS impact, hosting-control activity, hosted-content changes, and downstream cloud activity.

Behavioral Intelligence Maturity

Behavioral maturity is high.

The report identifies repeatable post-exposure behavior that can be detected across Joomla web, WAF, reverse-proxy, CDN, load-balancer, endpoint, EDR, Linux audit, file-integrity, DNS, proxy, firewall, NDR, CMS, FTP, hosting-control, SIEM, AWS, Azure, and Google Cloud platforms.

The behaviors are durable across CVE labels, extension names, exploit names, request path variation, source infrastructure, user-agent values, payload strings, PHP function names, webshell strings, file hashes, scanner signatures, actor branding, campaign names, tool names, and cloud-provider variation.

Strong Behavioral Anchors

·        Suspicious Joomla extension upload, profile-import, custom-icon upload, asset upload, image upload, media upload, AJAX upload, and request-handling behavior

·        JCE profile-import activity when correlated with source, route, site, and follow-on behavior

·        SP Page Builder upload behavior when correlated with source, route, site, and follow-on behavior

·        Page Builder CK upload behavior when correlated with source, route, site, and follow-on behavior

·        Writable-path PHP access and PHP-like web artifact access after suspicious upload activity

·        Web server service-context execution, shell or scripting interpreter use, transfer-tool use, archive-tool use, database-tool use, command execution, and suspicious process behavior

·        Sensitive Joomla file access, credential-file access, database access, database dump behavior, archive activity, and transfer activity

·        Rare outbound communication, suspicious destination access, new or rare domain access, unusual egress port, suspicious ASN, abnormal destination geography, and suspicious destination reputation

·        CMS administrator or Super User creation, plugin modification, template modification, redirect modification, mail-script modification, cron modification, .htaccess modification, FTP activity, hosting-control activity, hosted-content tampering, phishing hosting, malware hosting, and spam infrastructure

·        Downstream AWS, Azure, or Google Cloud activity following suspicious Joomla upload, webshell, credential-access, rare-egress, CMS-impact, FTP-abuse, hosting-control-abuse, or hosted-content-impact context

Telemetry Maturity

Telemetry maturity is moderate to high.

Joomla web, WAF, reverse-proxy, CDN, load-balancer, endpoint, EDR, Linux audit, file-integrity, DNS, proxy, firewall, NDR, CMS, FTP, hosting-control, SIEM, AWS, Azure, and Google Cloud telemetry provide strong coverage where Joomla site, public asset, virtual host, backend host, workload, source, path, file, process, destination, CMS account, hosting account, cloud principal, and timestamp fields are available and normalized.

Telemetry maturity decreases when Joomla web logs are incomplete, query strings are unavailable, extension route mapping is weak, writable-path references are stale, endpoint telemetry is unavailable, file telemetry is incomplete, source IP attribution is noisy, CMS state telemetry is inconsistent, hosting-control logs are unavailable, FTP logs are unavailable, downstream cloud logs are not correlated, or approved workflow baselines are weak.

Cloud and Hosting Maturity

Cloud and hosting maturity is moderate to strong.

AWS, Azure, and Google Cloud provide useful downstream cloud-impact visibility when cloud telemetry can be joined to suspicious Joomla context through workload, identity, source, host, storage, secret, KMS, service-account, resource, account, tenant, subscription, organization, project, or correlation lineage.

Cloud platforms do not independently prove Joomla exploitation, PHP webshell execution, credential theft, CMS compromise, hosting-control compromise, or data theft. Their strongest value comes from correlation with prior Joomla upload, webshell, sensitive-file, rare-egress, CMS-impact, FTP-abuse, hosting-control-abuse, hosted-content-impact, SOAR, incident-response, or SIEM-forwarded context.

Maturity increases when CloudTrail, Azure Activity, Entra ID, Key Vault, Storage, Google Cloud Audit Logs, Data Access logs, Cloud Storage logs, Secret Manager logs, KMS logs, Security Command Center, GuardDuty, Security Hub, Defender for Cloud, Sentinel, sensitive-resource inventories, and cloud identity mappings are normalized and validated.

Adversary-Resilience Maturity

Adversary-resilience maturity is high for behavior-led detection and moderate for high-confidence exploitation attribution.

The detection model is resilient because it avoids brittle indicators and focuses on behavior an adversary may produce when converting Joomla extension upload abuse into web-accessible PHP execution, credential access, database access, egress, CMS impact, hosting-control abuse, hosted-content abuse, or downstream cloud activity.

The model is less resilient when adversaries use expected administrator sources, expected user agents, approved hosting-provider paths, approved deployment workflows, normal media upload patterns, normal plugin update paths, expected backup or migration processes, approved cloud automation, or known business destinations. It is also less resilient when adversaries avoid webshell interaction, avoid endpoint process creation, avoid rare egress, avoid sensitive-file access, avoid CMS changes, avoid hosting-control activity, avoid cloud activity, and stop activity before downstream impact.

Operationalization Maturity

Operationalization maturity is moderate.

The S25 rules are implementation-ready detection patterns, but production deployment requires local validation of schemas, index names, sourcetypes, DSM fields, custom properties, ECS mappings, Joomla fields, WAF fields, endpoint fields, file fields, process fields, DNS fields, proxy fields, firewall fields, CMS fields, FTP fields, hosting-control fields, CloudTrail fields, Azure fields, Google Cloud audit fields, identity mappings, source mappings, workload mappings, cloud identity mappings, enrichment, exception lists, false-positive baselines, query performance, triage logic, and alert-routing decisions.

Operational maturity increases when detection owners validate each platform’s field mappings, confirm telemetry quality, baseline approved Joomla administration, extension updates, media uploads, deployments, hosting-provider support, vulnerability validation, backup, migration, maintenance, cleanup, cloud administration, service accounts, automation, CI/CD, infrastructure-as-code, break-glass, and incident-response workflows, and test sequence logic using realistic benign and suspicious event data.

Attribution Maturity

Attribution maturity is low to moderate.

The rule set supports detection of behavior consistent with suspicious Joomla extension upload abuse, web-accessible PHP artifact placement, web server service-context execution, credential access, database access, CMS impact, hosting-control activity, hosted-content abuse, and downstream cloud activity. It should not be used by itself to attribute activity to a specific adversary, campaign, exploit developer, infrastructure provider, malware family, or named threat group without external evidence and incident-specific validation.

Attribution requires corroborating evidence such as exploitation timeline, Joomla logs, request traces, file artifacts, source infrastructure, webshell artifacts, endpoint evidence, command history, CMS changes, FTP activity, hosting-control logs, destination infrastructure, cloud activity, victimology, actor tradecraft, and threat-intelligence reporting.

Maturity Limitations

Primary Maturity Limitations

·        Limited direct visibility into exploitation success

·        Limited direct visibility into PHP webshell operator control

·        Limited direct visibility into credential theft

·        Limited direct visibility into database theft

·        Limited direct visibility into CMS compromise

·        Limited direct visibility into hosted-content compromise

·        Variable Joomla web logging

·        Variable query-string and request-body visibility

·        Variable extension-route mapping

·        Variable writable-path and uploaded-path lineage

·        Variable file-integrity visibility

·        Variable endpoint and EDR visibility

·        Variable Linux audit coverage

·        Variable CMS state telemetry

·        Variable FTP telemetry

·        Variable hosting-control telemetry

·        Variable source IP stability

·        Variable destination reputation and first-seen coverage

·        Variable Joomla-to-AWS, Joomla-to-Azure, and Joomla-to-Google Cloud workload and identity correlation

·        Variable cloud data-event logging

·        Variable approved workflow baselines

·        High false-positive potential when detections are deployed without local tuning

Maturity Improvement Priorities

Priority Improvements

·        Improve Joomla web, WAF, reverse-proxy, CDN, load-balancer, and access-log retention

·        Improve Joomla site ID, public asset, virtual host, backend host, workload, exposure, and hosting-provider tagging

·        Improve Joomla extension inventory and upload-route mapping

·        Improve JCE profile-import, SP Page Builder upload, Page Builder CK upload, generic media upload, AJAX upload, writable-path, extension-owned path, and PHP-like artifact reference maintenance

·        Improve URI path, query string, HTTP method, content type, request size, response size, status sequence, source IP, forwarded source IP, user-agent, and timing normalization

·        Improve endpoint, EDR, Linux audit, file-integrity, process, command-line, parent-process, process-user, PHP runtime, and file-action telemetry for Joomla hosts

·        Improve sensitive Joomla file, credential-file, database-tool, archive-tool, transfer-tool, shell interpreter, scripting interpreter, and command-pattern references

·        Improve DNS, proxy, firewall, NDR, destination reputation, destination first-seen, domain age, ASN, geography, and egress-port normalization

·        Improve CMS state, administrator creation, Super User creation, plugin modification, template modification, redirect modification, mail-script modification, cron modification, .htaccess, FTP, hosting-control, and hosted-content monitoring

·        Improve SOAR and incident-response integration for containment and post-remediation context

·        Improve sensitive-resource inventories and hosted-content baselines

·        Improve Joomla-to-AWS, Joomla-to-Azure, and Joomla-to-Google Cloud workload, identity, source, host, storage, secret, KMS, service-account, and resource lineage

·        Enable relevant cloud data-event logging for sensitive AWS, Azure, and Google Cloud services

·        Build approved workflow baselines for Joomla administrators, extension updates, plugin updates, template updates, media uploads, deployment workflows, hosting-provider support, vulnerability validation, scanner activity, backup, restore, migration, malware cleanup, emergency remediation, cloud administration, service accounts, automation, CI/CD, infrastructure-as-code, managed-service access, break-glass use, security tooling, and incident-response activity

·        Test detection logic against realistic benign and suspicious sequences before alert promotion

Final Intelligence Maturity Assessment

The report’s intelligence maturity is strong for behavior-led detection engineering, strong for executive risk framing, moderate to strong for telemetry-driven operational detection, moderate to strong for Joomla web, endpoint, SIEM, egress, CMS, FTP, hosting-control, and cloud correlation, moderate for AWS, Azure, and Google Cloud downstream cloud correlation, and low to moderate for direct exploitation or attribution confirmation.

The S25 through S30 detection model is best used as an implementation-ready threat-to-detection framework that identifies suspicious Joomla extension upload, writable PHP access, endpoint service-context, sensitive-file, database, egress, CMS-impact, FTP, hosting-control, hosted-content, and downstream cloud-impact patterns. It should not be used as a standalone proof model for Joomla exploitation, PHP webshell execution, credential theft, database theft, CMS compromise, hosting-control compromise, hosted-content compromise, data theft, or cloud compromise without corroborating telemetry and incident-specific validation.

S31 — Telemetry Dependencies

Joomla extension exploitation and unauthenticated PHP webshell execution requires telemetry that can prove whether suspicious Joomla extension activity, upload or import behavior, PHP-like file placement, web-accessible execution, credential access, CMS state manipulation, outbound communication, hosting-control activity, hosted-content tampering, or post-remediation activity stayed within normal Joomla administration and hosting operations or created material webshell and hosted-content trust risk. The central dependency is the ability to correlate Joomla asset inventory, extension inventory, public exposure, web access logs, WAF events, reverse-proxy logs, CDN logs, load-balancer logs, Joomla administrative records, CMS database records, file telemetry, endpoint telemetry, DNS logs, proxy logs, firewall logs, FTP records, hosting-control records, malware scan results, backup comparison data, abuse-desk records, business-owner context, and remediation evidence into one Joomla request-to-impact investigation model.

Joomla Asset, Exposure, and Extension Telemetry

·        Joomla asset telemetry must identify public Joomla sites, customer-managed Joomla deployments, virtual hosts, backend hosts, shared-hosting accounts, cloud-hosted Joomla workloads, containerized Joomla workloads, dedicated Joomla servers, internet-facing endpoints, partner-facing endpoints, and business-critical web properties.

·        Extension telemetry must identify installed Joomla editor, page-builder, media, asset, icon, font, profile, image, upload, library, AJAX, and component-owned extensions, including JCE, SP Page Builder, Page Builder CK, and locally present upload-capable extensions.

·        Required fields include Joomla site name, public URL, virtual host, backend host, private IP, hosting model, Joomla version, extension name, extension version, extension path, extension owner, extension function, exposure state, writable paths, PHP execution state, administrator owner, business owner, and patch or remediation status where available.

·        This telemetry is required to determine whether suspicious request activity affected the correct exposure class: public Joomla sites with extension functionality capable of writing attacker-controlled content into web-accessible paths.

·        Asset and extension telemetry must be interpreted conservatively because unrelated PHP applications, WordPress sites, Drupal sites, static sites, internal-only Joomla deployments, non-upload extensions, and inactive extension paths may not share the same exposure or detection model.

Web, WAF, Reverse-Proxy, CDN, and Load-Balancer Telemetry

·        Web and gateway telemetry must capture Joomla request activity involving extension upload, import, profile, custom-icon, asset, media, image, library, archive extraction, and AJAX behavior.

·        Required fields include timestamp, Joomla site, virtual host, backend host, source IP, forwarded client IP where available, URI path, URI query, HTTP method, status code, response size, request size, user agent, referrer, content type, action, WAF disposition, and extension route where available.

·        This telemetry is required to determine whether suspicious external activity involved malformed, unusual, repeated, or automation-like requests against Joomla extension paths and whether those requests aligned with abnormal response behavior, failed-to-success sequences, upload-handler errors, archive upload behavior, or later PHP-like file access.

·        Web request telemetry must be interpreted against approved Joomla administration, extension updates, media uploads, template changes, vulnerability validation, hosting-provider support, monitoring, maintenance windows, malware cleanup, and incident-response activity.

·        Request-path telemetry should not be used as a standalone compromise signal because public Joomla sites are routinely scanned and upload-path access may occur during benign administration or validation.

File, Webroot, and Persistence Telemetry

·        File telemetry must capture creation, modification, rename, write, read, delete, ownership, permission, timestamp, and path activity across Joomla webroots and extension-owned writable directories.

·        Required coverage includes media, images, tmp, cache, uploads, assets, iconfont, fonts, gfonts, templates, plugins, components, modules, libraries, backup directories, administrator paths, and extension-owned web-accessible locations.

·        Required fields include host, virtual host, file path, file name, extension, file owner, process where available, file action, timestamp, file size, hash where available, directory family, backup comparison status, and approved deployment context where available.

·        This telemetry is required to determine whether suspicious Joomla extension activity resulted in PHP, phtml, phar, PHP-like, mixed-case PHP, double-extension, archive-extracted, renamed, short-lived, or obfuscated files in locations where executable content should not normally appear.

·        File telemetry must be interpreted against approved deployments, plugin updates, template changes, media operations, backup extraction, restore activity, migrations, malware cleanup, hosting-provider maintenance, and incident-response actions.

Endpoint, Process, and Runtime Execution Telemetry

·        Endpoint telemetry must capture web server service-context execution, process creation, parent process, command line, process user, current directory, executable path, container context where applicable, and endpoint identity for Joomla hosts.

·        Required fields include host, endpoint ID, process name, parent process name, process user, command line, current directory, file path, event type, timestamp, destination host where applicable, destination IP where applicable, and web server service account.

·        This telemetry is required to determine whether PHP-like artifacts were only placed in a writable path or were accessed and used to execute attacker-controlled functionality through Apache, Nginx, LiteSpeed, OpenLiteSpeed, PHP-FPM, php-cgi, cgi-fcgi, lsphp, or hosting-provider service wrappers.

·        Endpoint telemetry must be interpreted against approved deployment tools, backup jobs, restore jobs, migrations, vulnerability validation, malware scanning, emergency cleanup, hosting-provider support, and approved administrative scripts.

·        Runtime execution telemetry may be unavailable in shared-hosting or managed Joomla environments and should be treated as high-value evidence when present, not as a guaranteed telemetry source.

CMS State, Administrator, and Database Telemetry

·        CMS telemetry must capture Joomla administrator activity, Super User state, extension configuration, editor profiles, page-builder assets, upload policy, media library state, templates, plugins, modules, redirects, .htaccess rules, mail scripts, scheduled tasks, cron entries, and content records.

·        Required fields include CMS user, user ID, role, source IP where available, session identifier where available, object changed, old value where available, new value where available, extension family, administrator action, timestamp, database table, record identifier, and change owner where available.

·        This telemetry is required to determine whether suspicious Joomla extension activity moved into administrator exposure, CMS state manipulation, upload policy change, malicious redirect creation, template modification, plugin modification, mail script placement, or hosted-content change.

·        Joomla administrative telemetry must be interpreted against approved administrators, hosting-provider support, emergency remediation, extension updates, template changes, content publishing, media uploads, migration work, malware cleanup, and documented incident response.

·        Where native Joomla audit records are absent, CMS database inspection and backup comparison may be required to reconstruct state changes.

Network, DNS, Proxy, Firewall, and Egress Telemetry

·        Network telemetry must capture inbound and outbound communication involving Joomla hosts, including DNS queries, proxy activity, firewall activity, EDR network activity, NDR metadata where available, hosting-provider egress records, destination domains, destination IPs, destination ports, protocols, timestamps, actions, and enrichment.

·        Source-enrichment telemetry should identify rare inbound sources, suspicious ASNs, cloud-hosted infrastructure, residential proxy infrastructure, VPN provider infrastructure, scanner infrastructure, compromised-host indicators, newly observed sources, and geographies inconsistent with normal Joomla administration or customer traffic.

·        Outbound telemetry should identify rare destinations, newly observed domains, raw-IP communication, paste-site access, file-sharing access, suspicious HTTP or HTTPS destinations, abnormal SMTP activity, command-and-control-like communication, malware hosting support, spam infrastructure, or traffic inconsistent with normal Joomla update, CDN, analytics, mail, hosting-provider, backup, monitoring, or administrative workflows.

·        This telemetry is required to connect suspicious upload behavior, PHP-like file placement, web-accessible execution, sensitive-file access, CMS state changes, hosted-content tampering, and abuse infrastructure into one investigation timeline.

·        Network telemetry must not be used as standalone exploit confirmation because it may lack request body detail, file evidence, process attribution, CMS state, user attribution, or hosted-content context.

FTP, Hosting-Control, Backup, and Abuse-Desk Telemetry

·        FTP and hosting-control telemetry must capture file-manager activity, FTP access, SFTP access, hosting-control panel access, backup jobs, restore jobs, account changes, permission changes, webroot changes, mail setting changes, domain changes, DNS changes, and provider-side malware or abuse events.

·        Required fields include account, source IP, source geography, host, virtual host, path, action, file name, object changed, timestamp, authentication result, provider action, and maintenance or support context where available.

·        Backup and malware scanning telemetry must capture known-good webroot baselines, backup comparison results, restored files, detected malicious artifacts, quarantined files, removed files, and scan timestamps.

·        Abuse-desk telemetry must capture phishing complaints, malware-hosting reports, spam complaints, search-engine warnings, browser warnings, customer reports, partner reports, and provider notifications.

·        This telemetry is required to determine whether Joomla exploitation created visible hosted-content impact, post-remediation persistence, abuse infrastructure, or provider-level trust consequences.

Remediation, Incident Response, and Business-Workflow Context

·        Remediation telemetry must capture extension remediation, Joomla patch validation, vulnerable extension removal, PHP execution restriction, writable-path review, webroot cleanup, credential rotation, administrator review, Super User review, database review, configuration-file review, outbound review, hosting-provider coordination, content restoration, and post-remediation monitoring.

·        Incident-response records must capture affected site, affected extension, affected path, affected file, affected administrator account, affected credential material, affected hosted content, containment action, action owner, timestamp, validation status, evidence source, decision owner, and closure rationale.

·        Business workflow context must capture approved Joomla administrators, approved hosting-provider support sources, approved vulnerability scanners, approved validation sources, approved deployment users, approved media upload workflows, approved template update workflows, approved backup jobs, approved maintenance windows, approved emergency remediation windows, and approved incident-response activity.

·        This telemetry is required to determine whether containment was complete, whether suspicious access continued after remediation, whether credential exposure was scoped, and whether observed activity aligned with approved Joomla operations.

·        Remediation should not be assumed complete unless extension state, writable-path controls, PHP execution restrictions, webroot integrity, administrator state, credential exposure, outbound activity, hosting-control activity, hosted-content review, and post-remediation monitoring are explicitly validated.

S32 — Detection Limitations

Detection of Joomla extension exploitation and unauthenticated PHP webshell execution is limited by whether the organization can reconstruct the relationship between exposed Joomla assets, vulnerable or weakly controlled extension behavior, suspicious request activity, attacker-controlled upload state, PHP-like file placement, HTTP access to planted artifacts, web server service-context execution, credential or configuration access, CMS state manipulation, outbound communication, FTP or hosting-control activity, hosted-content impact, remediation evidence, and approved Joomla administration or hosting workflows. Environments that rely only on vulnerable-version status, scanner findings, public exploit references, single request strings, isolated source IPs, unusual user agents, generic PHP filenames, web errors, or abuse complaints will not have enough evidence for high-confidence compromise or impact determination.

Primary Limitations

·        Missing Joomla asset inventory may prevent identification of public Joomla sites, customer-managed deployments, virtual hosts, backend hosts, shared-hosting accounts, cloud workloads, containerized workloads, business owners, and exposed endpoints.

·        Missing Joomla extension inventory may prevent review of JCE, SP Page Builder, Page Builder CK, media managers, editor extensions, page-builder extensions, asset uploaders, icon or font handlers, profile import functions, archive extraction behavior, AJAX upload paths, and component-owned writable paths.

·        Missing web, WAF, reverse-proxy, CDN, or load-balancer logs may prevent reliable assessment of suspicious request activity, request sequence, source context, URI path, query string, request method, status code, response size, content type, upload behavior, and failed-to-success patterns.

·        Missing query-string preservation may prevent detection of extension-specific behavior such as option=com_jce, task=profiles.import, option=com_sppagebuilder, task=asset.uploadCustomIcon, Page Builder CK upload behavior, browse.ajaxAddPicture, or locally relevant extension routes.

·        Missing file telemetry may prevent identification of PHP-like file creation, archive-extracted payloads, renamed artifacts, modified templates, altered plugins, changed .htaccess files, unexpected mail scripts, or short-lived webshell artifacts.

·        Missing endpoint telemetry may prevent review of web server service-context execution, child process activity, command-line behavior, sensitive-file access, database access, transfer-tool use, archive-tool use, encoding behavior, or rare egress by process.

·        Missing CMS administrative or database telemetry may prevent reliable assessment of administrator changes, Super User changes, editor profile changes, page-builder asset changes, upload policy changes, plugin changes, template changes, redirect changes, content changes, and scheduled task changes.

·        Missing DNS, proxy, firewall, EDR network, NDR, or hosting-provider egress telemetry may prevent assessment of rare outbound communication, suspicious destinations, paste-site access, file-sharing access, raw-IP communication, abnormal SMTP behavior, or command-and-control-like activity.

·        Missing FTP, file-manager, hosting-control, backup, malware scan, or abuse-desk records may prevent review of manual file changes, provider-side remediation, backup restoration, malware cleanup, spam complaints, phishing reports, search-engine warnings, or post-remediation abuse.

·        Missing change-control, maintenance, hosting-provider support, deployment, backup, migration, vulnerability-validation, emergency cleanup, malware-scan, and incident-response records may prevent reliable false-positive control.

·        Short log retention may prevent reconstruction of the period between suspicious upload activity, PHP-like file creation, webshell access, credential-file access, outbound communication, hosted-content tampering, patching, cleanup, and post-remediation validation.

·        Poor timestamp normalization can break sequence logic between web request telemetry, file activity, endpoint telemetry, CMS state, outbound communication, FTP activity, hosting-control activity, backup comparison, malware scanning, abuse reports, and remediation records.

·        Incomplete host, virtual-host, source, forwarded-source, path, file, user, administrator, destination, extension, and business-owner normalization can prevent reliable correlation across Joomla, web, host, network, hosting-provider, and incident-response telemetry.

Detection Boundary

·        A vulnerable Joomla version, vulnerable extension, public exploit reference, KEV status, scanner hit, rare source IP, unusual user agent, suspicious URI, PHP filename, web error, upload attempt, or abuse report is not proof of compromise by itself.

·        Suspicious Joomla extension activity should not be treated as successful exploitation without PHP-like file placement, HTTP access to planted artifacts, web server execution evidence, sensitive-file access, CMS state change, outbound communication, hosting-control activity, hosted-content impact, or active exploitation intelligence.

·        PHP-like file presence should not be treated as webshell execution unless it aligns with suspicious request activity, HTTP access, process behavior, sensitive-file access, outbound communication, CMS state change, or artifact analysis.

·        Web server process behavior should not be attributed to Joomla extension exploitation unless tied to Joomla asset, source, path, uploaded file, request sequence, CMS state, or bounded time-window evidence.

·        Credential access, database activity, FTP activity, hosting-control activity, outbound communication, or hosted-content changes should not be attributed to Joomla exploitation without Joomla host, file, source, administrator, extension, or time-window linkage.

·        Cloud-only anomalies, identity-only anomalies, database-only anomalies, mail-only anomalies, network-only anomalies, or hosting-control-only anomalies should not be treated as Joomla extension compromise without application-layer, host, file, CMS state, or workload correlation.

·        Legitimate Joomla administration, extension updates, template changes, media uploads, backups, migrations, malware scans, vulnerability validation, hosting-provider support, emergency remediation, and incident-response cleanup can create overlapping signals.

·        Detection logic must not rely on prior alert state, another rule’s output, analyst judgment after alert generation, DRI, or TCR as an input.

·        High-confidence alerting should require validated multi-signal correlation across Joomla request behavior, file placement, HTTP access, endpoint execution, sensitive-file access, CMS state, outbound communication, hosting-control activity, hosted-content review, remediation evidence, and approved workflow context where applicable.

Operational Impact of Limitations

Detection coverage should be reduced, scoped down, converted to hunt-only logic, or withheld when required telemetry is unavailable, incomplete, delayed, sampled, inconsistently normalized, or unable to support bounded sequence correlation. Suspicious Joomla extension activity may be analytically important but unsuitable for high-confidence alerting if the organization cannot validate asset exposure, extension presence, request sequence, PHP-like file placement, web access, endpoint execution, credential access, CMS state, outbound behavior, hosting-control activity, hosted-content impact, remediation status, and approved Joomla administration or hosting workflow evidence within locally validated correlation windows.

S33 — Defensive Control & Hardening Improvements

Defensive improvement should focus on making Joomla exposure, extension state, upload behavior, writable paths, PHP execution controls, webroot integrity, administrator state, credential exposure, outbound communication, hosting-control activity, hosted-content integrity, and post-remediation activity measurable, governed, and resilient under active public web exploitation pressure. The objective is not only to patch one extension, block one scanner, or remove one PHP file, but to prove that Joomla activity can be scoped, correlated, contained, and separated from legitimate administration and hosting workflows when webshell execution or hosted-content trust exposure is suspected.

Joomla Asset, Extension, and Exposure Governance

·        Maintain a complete inventory of public Joomla sites, customer-managed deployments, virtual hosts, backend hosts, shared-hosting accounts, cloud-hosted Joomla workloads, containerized Joomla workloads, internet-facing endpoints, partner-facing endpoints, public web properties, business owners, and hosted-content owners.

·        Maintain a complete inventory of upload-capable Joomla extensions, including editor, page-builder, media, asset, icon, font, profile, image, upload, archive extraction, AJAX, library, and component-owned extensions.

·        Prioritize remediation for Joomla sites and extensions supporting customer portals, partner workflows, regulated content, payment-adjacent pages, public downloads, support portals, executive communications, marketing campaigns, high-traffic pages, or shared backend infrastructure.

·        Require auditable change-control for Joomla patching, extension updates, extension removal, PHP execution restrictions, writable-path changes, administrator changes, Super User changes, template changes, plugin changes, redirect changes, backup restoration, hosting-provider changes, and emergency remediation.

·        Treat unknown extension state, unknown writable-path exposure, unknown PHP execution controls, or unknown public Joomla ownership as enterprise public web trust risk until exposure is resolved.

Upload, Writable-Path, and PHP Execution Hardening

·        Restrict upload-capable Joomla functionality to approved administrators, approved workflows, approved file types, approved content types, approved paths, and approved maintenance windows where feasible.

·        Disable PHP execution in writable Joomla directories such as media, images, tmp, cache, uploads, assets, iconfont, fonts, gfonts, and extension-owned paths where operationally feasible.

·        Monitor and restrict archive upload, archive extraction, profile import, custom-icon upload, page-builder upload, AJAX upload, media upload, image upload, asset upload, and component-owned write behavior.

·        Validate that Joomla extensions cannot place executable content into web-accessible paths without approved administrative action.

·        Treat PHP, phtml, phar, mixed-case PHP, double-extension, archive-extracted PHP, renamed PHP, short-lived PHP, or obfuscated PHP files in writable Joomla paths as high-priority investigation artifacts.

Webroot, File Integrity, and CMS State Hardening

·        Enable file-integrity monitoring or scheduled webroot integrity checks across Joomla webroots, writable directories, extension-owned paths, template directories, plugin directories, component directories, module directories, backup directories, and administrator-relevant paths.

·        Maintain known-good webroot baselines and compare affected Joomla sites against validated backups when suspicious extension activity occurs.

·        Monitor Joomla administrator accounts, Super User accounts, editor profiles, page-builder assets, media library state, upload policy state, extension configuration, templates, plugins, redirects, .htaccess rules, mail scripts, cron entries, scheduled tasks, and content records.

·        Review CMS database state when native Joomla audit records are absent or insufficient.

·        Treat unexplained administrator changes, template edits, plugin changes, redirect changes, .htaccess changes, mail script changes, or content modifications after suspicious extension activity as high-priority investigation context.

Credential, Database, and Hosting-Control Hardening

·        Protect and monitor configuration.php, database credentials, database dumps, backup archives, environment files, FTP material, mail settings, API keys, deployment secrets, reused credentials, and administrator credential material.

·        Restrict access to FTP, SFTP, hosting-control panels, file managers, database administration tools, backup systems, and deployment workflows to approved users, approved sources, and monitored administrative paths.

·        Require credential review or rotation when suspicious Joomla extension activity aligns with PHP-like file placement, webshell access, sensitive-file access, administrator changes, outbound communication, or incomplete containment.

·        Monitor database access, dump creation, configuration-file access, backup access, mail configuration changes, FTP activity, hosting-control activity, and file-manager activity after suspicious Joomla behavior.

·        Treat shared hosting, reused credentials, shared databases, sibling virtual hosts, and common deployment workflows as scope-expansion conditions.

Network, Source, and Egress Hardening

·        Enrich WAF, firewall, proxy, DNS, NDR, reverse-proxy, CDN, load-balancer, endpoint-adjacent, and hosting-provider telemetry with Joomla site identity, virtual host, backend host, source reputation, ASN, geography, network type, request path, response metadata, destination context, and approved-source status.

·        Monitor rare inbound sources, suspicious ASNs, cloud-hosted infrastructure, residential proxy infrastructure, VPN provider infrastructure, scanner infrastructure, geographically inconsistent access paths, abnormal request timing, repeated upload attempts, and low-and-slow probing against Joomla extension paths.

·        Monitor outbound traffic from Joomla hosts for rare destinations, raw-IP communication, paste-site access, file-sharing access, abnormal SMTP behavior, newly observed domains, low-reputation infrastructure, unusual ports, unexpected protocols, and traffic inconsistent with normal Joomla update, plugin, CDN, analytics, mail, hosting-provider, backup, monitoring, or administrative behavior.

·        Maintain allowlists for approved Joomla administrators, hosting-provider support sources, vulnerability scanners, deployment systems, validation sources, monitoring systems, backup destinations, update destinations, CDN services, analytics services, mail services, and business-required egress.

·        Treat network telemetry as supporting context rather than standalone proof of Joomla exploitation, webshell execution, credential exposure, command-and-control, data theft, or hosted-content compromise.

Hosted-Content, Abuse-Desk, and Trust Hardening

·        Review hosted content for defacement, injected redirects, phishing pages, malware hosting, unauthorized file distribution, spam scripts, SEO poisoning, modified templates, suspicious scripts, browser warnings, search-engine warnings, and customer-facing integrity changes.

·        Monitor abuse-desk records, hosting-provider notifications, spam complaints, malware scan detections, phishing reports, customer reports, partner reports, search-console alerts, and browser warning signals after suspicious Joomla activity.

·        Require content owners and business owners to validate whether affected pages support customer portals, partner workflows, regulated content, payment-adjacent activity, public downloads, executive communications, marketing campaigns, support portals, or high-visibility brand pages.

·        Treat hosted-content abuse after Joomla extension activity as a business trust issue requiring technical scoping, content restoration, legal review where applicable, communications planning where applicable, and executive assurance.

·        Confirm that public Joomla properties can safely remain online only after webroot integrity, hosted-content integrity, credential exposure, administrator state, outbound communication, and post-remediation monitoring are validated.

Incident Response and Containment Hardening

·        Create response procedures for suspicious Joomla extension activity, upload or import abuse, PHP-like file placement, webshell access, credential-file access, administrator changes, outbound communication, hosting-control activity, hosted-content tampering, abuse reports, and post-remediation activity.

·        Require responders to validate affected Joomla site, affected extension, affected path, request activity, uploaded file, PHP execution state, webroot integrity, credential exposure, administrator state, CMS state, outbound communication, FTP activity, hosting-control activity, hosted-content impact, business owner, data sensitivity, and remediation status.

·        Prepare decision paths for emergency extension removal, Joomla patching, PHP execution restriction, webroot cleanup, credential rotation, database review, configuration review, administrator review, hosting-provider escalation, abuse-desk remediation, content restoration, legal and compliance escalation, cyber-insurance coordination, communications planning, executive reporting, and customer or partner trust management.

·        Treat suspected Joomla webshell execution as a public web trust, credential exposure, CMS integrity, hosted-content abuse, and containment-validation incident, not a routine scanner alert, isolated Joomla error, single vulnerable-extension finding, or patch-management task.

·        Require post-event validation to distinguish approved Joomla administration, extension updates, media uploads, template changes, backups, migrations, malware scans, vulnerability validation, hosting-provider support, emergency remediation, and incident-response cleanup from attacker-driven behavior.

S34 — Defensive Control & Hardening Architecture

Figure 6

Joomla extension exploitation defensive architecture showing Joomla asset and extension governance, upload and writable-path control, PHP execution restriction, webroot integrity monitoring, CMS state validation, credential and hosting-control protection, outbound and abuse-infrastructure monitoring, SOC triage, and executive public-web trust restoration.

The defensive architecture should treat public Joomla sites as governed web trust and hosted-content infrastructure rather than isolated websites or routine content-management systems. The architecture must connect Joomla asset inventory, extension inventory, upload governance, writable-path control, PHP execution restriction, webroot integrity monitoring, CMS state validation, administrator governance, credential protection, outbound monitoring, hosting-control oversight, abuse-desk review, incident-response containment, and executive web trust decisioning into one Joomla request-to-impact assurance model.

Architecture Layer One — Joomla Asset and Extension Governance

Joomla asset and extension governance establishes which public Joomla sites exist, which sites are internet-facing or partner-facing, which extensions can upload or write files, which paths are web-accessible, which business workflows depend on the site, and which assets require remediation. This layer captures Joomla site identity, public endpoint, virtual host, backend host, hosting model, extension inventory, writable-path inventory, PHP execution state, administrator owner, business owner, hosted-content sensitivity, patch state, and operational dependency.

Architecture Layer Two — Web Request and Extension Upload Visibility

Web request and extension upload visibility determines whether suspicious external activity remained routine scanning or administration or became exploit-relevant behavior. This layer captures WAF events, web access logs, reverse-proxy logs, CDN logs, load-balancer records, HTTP method, URI path, query string, source IP, forwarded source IP, user agent, request size, response size, content type, status code, extension route, upload behavior, archive behavior, failed-to-success sequences, upload-handler errors, and maintenance-window context.

Architecture Layer Three — Writable-Path and PHP Execution Control

Writable-path and PHP execution control determines whether attacker-controlled content can become executable. This layer captures media paths, images paths, tmp paths, cache paths, upload paths, asset paths, iconfont paths, fonts paths, gfonts paths, template paths, plugin paths, component paths, module paths, extension-owned paths, PHP execution restrictions, allowed file types, allowed content types, upload policy, and path-specific runtime behavior.

Architecture Layer Four — File Integrity and Webroot Monitoring

File integrity and webroot monitoring determines whether suspicious upload behavior resulted in PHP-like artifact placement or webroot modification. This layer captures file creation, modification, rename, read, write, delete, ownership, permissions, timestamps, file hashes where available, known-good baselines, backup comparison, malware scan results, short-lived artifacts, archive-extracted files, modified templates, altered plugins, changed .htaccess files, mail scripts, and unexpected webroot content.

Architecture Layer Five — Endpoint Runtime and Web Server Context

Endpoint runtime and web server context determines whether suspicious PHP-like artifacts were executed. This layer captures Apache, Nginx, LiteSpeed, OpenLiteSpeed, PHP-FPM, php-cgi, cgi-fcgi, lsphp, container runtime, hosting-provider service wrappers, web server service users, process lineage, command line, current directory, child process activity, shell activity, scripting interpreters, transfer tools, archive tools, database tools, encoding behavior, sensitive-file access, and endpoint network activity.

Architecture Layer Six — CMS State, Administrator, and Credential Protection

CMS state, administrator, and credential protection determines whether exploitation affected Joomla control, credential material, or administrative trust. This layer captures administrator accounts, Super User accounts, CMS sessions, extension configuration, editor profiles, page-builder assets, media library state, upload policy state, templates, plugins, redirects, .htaccess rules, mail scripts, scheduled tasks, cron entries, content records, configuration.php, database credentials, database dumps, backup archives, environment files, FTP material, mail settings, API keys, and deployment secrets.

Architecture Layer Seven — Network Egress, Hosting-Control, and Abuse Context

Network egress, hosting-control, and abuse context determines whether the Joomla host became abuse infrastructure or whether hosting workflows expanded exposure. This layer captures DNS queries, proxy events, firewall events, NDR signals, outbound HTTP or HTTPS, raw-IP communication, paste-site access, file-sharing access, SMTP behavior, suspicious third-party destinations, FTP activity, file-manager activity, hosting-control activity, backup jobs, restore jobs, provider malware detections, abuse-desk reports, spam complaints, phishing reports, browser warnings, search-engine warnings, customer reports, and partner reports.

Architecture Layer Eight — SOC Correlation and False-Positive Control

SOC correlation joins Joomla asset context, extension inventory, upload behavior, web request telemetry, file telemetry, endpoint execution telemetry, CMS state, administrator context, sensitive-file access, outbound communication, FTP activity, hosting-control activity, backup comparison, malware scan results, abuse-desk records, change-control records, maintenance windows, vulnerability-validation activity, hosting-provider support, and business workflow baselines. This layer validates whether activity is attacker-driven, scanner-driven, administrator-driven, deployment-driven, hosting-provider-driven, maintenance-related, validation-related, malware-cleanup-related, or incident-response-related.

Architecture Layer Nine — Incident Response and Executive Web Trust Workflow

Incident response and executive web trust workflow connects technical validation to business decisions. This layer captures incident severity, affected Joomla sites, affected extensions, affected paths, affected files, affected administrators, affected credentials, affected content, affected customer or partner workflows, patch validation, extension remediation, PHP execution restriction, webroot cleanup, credential rotation, administrator review, outbound review, hosting-provider coordination, abuse-desk remediation, legal review, compliance review, cyber-insurance coordination, communications planning, executive reporting, board-level assurance, and validation that public Joomla services can safely remain online.

Architecture Outcome

The architecture should enable the organization to answer seven questions during a Joomla extension exploitation and webshell execution incident:

·        Which Joomla site, extension, upload route, writable path, PHP artifact, webroot, backend host, administrator account, credential source, outbound destination, hosted-content item, business owner, or remediation action was affected?

·        Did the activity align with approved Joomla administrators, hosting-provider support, vulnerability scanners, deployment workflows, media uploads, template changes, extension updates, backup jobs, migrations, malware scans, maintenance windows, emergency remediation, or incident-response activity?

·        Did suspicious Joomla extension activity transition into PHP-like file placement, HTTP access to planted artifacts, web server service-context execution, credential-file access, CMS state change, outbound communication, hosting-control activity, hosted-content impact, or post-remediation activity?

·        Did the activity affect customer portals, partner workflows, regulated content, payment-adjacent pages, public downloads, support portals, executive communications, marketing campaigns, high-visibility brand pages, shared hosting, reused credentials, or adjacent web properties?

·        Can the organization remediate affected extensions, restrict PHP execution, validate writable paths, inspect webroot integrity, rotate credentials, review administrator state, review hosted content, preserve evidence, and restore public website availability without over-attributing unrelated Joomla administration or hosting activity to exploitation?

·        Can the organization prove that Joomla request activity, file changes, CMS changes, outbound communication, hosting-control activity, and hosted-content changes were approved operational activity rather than suspicious follow-on behavior?

·        Can leadership make defensible decisions about credential exposure, hosted-content integrity, customer or partner trust, regulatory review, cyber-insurance coordination, abuse-provider response, notification analysis, and public web trust restoration?

S35 — Defensive Control Mapping Matrix

Preventive Controls

·        Maintain complete inventory of public Joomla sites, customer-managed deployments, virtual hosts, backend hosts, hosting models, Joomla versions, upload-capable extensions, extension versions, writable paths, PHP execution state, administrator owners, business owners, and hosted-content sensitivity.

·        Enforce timely Joomla and extension remediation, emergency patch procedures, vulnerable extension removal, upload restriction, PHP execution restriction in writable paths, source restrictions for administration, role-based administration, MFA for administrators where supported, and change-control validation.

·        Restrict FTP, SFTP, file-manager, hosting-control, database administration, backup, deployment, and mail-configuration access to approved users, approved sources, and monitored workflows.

·        Harden Joomla editor, page-builder, media, asset, icon, font, profile, image, upload, archive extraction, and AJAX behavior to prevent executable file placement in web-accessible paths.

·        Maintain allowlists for approved administrators, hosting-provider support sources, vulnerability scanners, deployment systems, validation sources, maintenance windows, backup destinations, update destinations, monitoring destinations, CDN services, analytics services, mail services, and business-required egress.

·        Prioritize preventive controls for Joomla sites supporting customer portals, partner workflows, regulated content, payment-adjacent pages, public downloads, support portals, executive communications, marketing campaigns, high-traffic pages, shared hosting, reused credentials, and adjacent web properties.

Detective Controls

·        Monitor malformed, unusual, repeated, or automation-like requests against Joomla extension upload, import, profile, custom-icon, asset, media, image, archive extraction, library, and AJAX paths.

·        Monitor option=com_jce with task=profiles.import, option=com_sppagebuilder with task=asset.uploadCustomIcon, Page Builder CK upload behavior, browse.ajaxAddPicture behavior, and locally present upload-capable extension routes.

·        Monitor archive uploads, multipart form submissions, abnormal request sizes, rare user agents, unusual parameter names, failed-to-success sequences, abnormal status-code patterns, response-size deviations, and upload-handler errors.

·        Monitor PHP, phtml, phar, mixed-case PHP, double-extension, archive-extracted, renamed, short-lived, or obfuscated PHP artifacts in Joomla writable or extension-owned paths.

·        Monitor HTTP GET or POST access to newly created PHP-like files in Joomla media, images, tmp, cache, uploads, assets, iconfont, gfonts, templates, plugins, components, modules, libraries, backup directories, or extension-owned paths.

·        Monitor web server service-context execution, shell activity, scripting interpreter use, transfer-tool activity, archive-tool activity, database-tool activity, encoding behavior, sensitive-file access, and rare egress after suspicious Joomla activity.

·        Monitor Joomla administrator changes, Super User changes, editor profile changes, page-builder asset changes, media library changes, upload policy changes, extension configuration changes, template changes, plugin changes, redirect changes, .htaccess changes, mail script changes, scheduled task changes, and content changes.

·        Monitor DNS, proxy, firewall, EDR network, NDR, and hosting-provider egress for rare destinations, raw-IP communication, paste-site access, file-sharing access, abnormal SMTP behavior, suspicious HTTP or HTTPS destinations, newly observed domains, low-reputation infrastructure, and traffic inconsistent with normal Joomla behavior.

·        Monitor FTP activity, file-manager activity, hosting-control activity, backup activity, restore activity, provider malware detections, abuse-desk reports, spam complaints, phishing reports, malware hosting reports, search-engine warnings, browser warnings, customer reports, and partner reports.

·        Require multi-signal Joomla request-to-file, request-to-execution, or request-to-impact correlation before high-confidence alerting or compromise determination.

Responsive Controls

·        Remediate affected Joomla extensions, remove vulnerable or unnecessary upload-capable extensions, patch Joomla where applicable, validate affected extension state, and reduce unnecessary public exposure.

·        Preserve WAF, reverse-proxy, CDN, load-balancer, web access, Joomla administrative, CMS database, file, endpoint, DNS, proxy, firewall, FTP, hosting-control, backup, malware scan, abuse-desk, and remediation evidence before log rotation or cleanup.

·        Search writable Joomla paths for PHP-like files, mixed-case PHP, double extensions, obfuscated PHP, newly created artifacts, unexpected archives, modified templates, altered plugins, changed .htaccess files, mail scripts, redirects, and component-owned executable content.

·        Disable PHP execution in writable Joomla directories where operationally feasible and validate that restrictions do not break approved business workflows.

·        Review Joomla administrator accounts, Super User accounts, extension configuration, editor profiles, page-builder assets, media library state, upload policy state, templates, plugins, modules, components, redirects, scheduled tasks, cron entries, and content records.

·        Review configuration.php, database credentials, database dumps, backup archives, FTP material, mail settings, API keys, deployment secrets, reused credentials, and administrator credential material.

·        Rotate Joomla administrator, database, FTP, hosting-control, SSH, mail, API, deployment, and reused credentials when compromise cannot be ruled out.

·        Review outbound communication, FTP activity, file-manager activity, hosting-control activity, backup access, mail behavior, hosted-content integrity, malware scan findings, abuse-provider reports, spam complaints, phishing reports, and post-remediation access.

·        Perform legal and compliance review, cyber-insurance coordination, communications planning, customer or partner notification analysis, executive reporting, and board-level web trust assurance where credential exposure, regulated data concern, hosted-content tampering, phishing, malware hosting, spam infrastructure, or incomplete containment is suspected.

·        Confirm that Joomla request activity, file state, CMS state, credential exposure, outbound communication, hosting-control activity, hosted content, and post-remediation monitoring support closure before the incident is considered contained.

Governance Controls

·        Maintain approved inventories for Joomla sites, public endpoints, extensions, versions, writable paths, approved PHP paths, administrators, Super Users, hosting providers, deployment users, FTP users, file-manager users, database users, business owners, content owners, and hosted-content sensitivity.

·        Maintain approved workflows for Joomla administration, extension updates, media uploads, template changes, plugin changes, backups, migrations, vulnerability validation, malware scanning, hosting-provider support, emergency remediation, incident-response cleanup, content restoration, and abuse-provider response.

·        Require change-control records for Joomla patching, extension remediation, extension removal, PHP execution restrictions, writable-path changes, administrator changes, Super User changes, template changes, plugin changes, redirect changes, .htaccess changes, hosting-provider changes, credential rotation, and content restoration.

·        Maintain escalation criteria for suspicious extension upload activity, PHP-like file placement, webshell access, sensitive-file access, administrator changes, outbound communication, FTP activity, hosting-control activity, hosted-content tampering, abuse complaints, post-remediation activity, and unresolved exposure.

·        Track Joomla extension exploitation and webshell execution risk in the risk register when telemetry, patching, upload controls, writable-path controls, PHP execution restrictions, credential protection, hosted-content visibility, hosting-provider visibility, or response gaps create unresolved enterprise risk.

Control Mapping Summary

The strongest control posture combines prevention of unnecessary Joomla exposure, detection of suspicious extension request-to-file or request-to-impact behavior, and response workflows that restore public web trust, credential confidence, CMS integrity, hosted-content integrity, hosting-control confidence, and business continuity. Controls should be prioritized for Joomla environments supporting customer portals, partner workflows, regulated content, payment-adjacent experiences, public downloads, support services, executive communications, marketing operations, high-traffic brand pages, shared hosting, reused credentials, and business-critical web delivery.

S36 — CyberDax Intelligence Maturity Assessment

Current Intelligence Maturity

Moderate

Maturity Rationale

Joomla extension exploitation and unauthenticated PHP webshell execution is a well-defined behavior class, but organization-specific maturity depends on whether suspicious Joomla extension activity, upload or import behavior, PHP-like file placement, web-accessible execution, credential access, CMS state manipulation, outbound communication, hosting-control activity, hosted-content impact, post-remediation activity, and approved Joomla administration or hosting workflows can be correlated. Many environments can identify exposed Joomla sites, vulnerable extensions, internet scanning, or suspicious PHP files, but fewer can prove whether suspicious Joomla activity resulted in webshell execution, credential exposure, administrator compromise, hosted-content tampering, abuse infrastructure, or containment failure.

Strengths

·        The behavior pattern is durable because it focuses on Joomla request-to-impact tradecraft rather than one scanner fingerprint, actor name, source IP, request path, user agent, extension label, filename, payload, response code, vulnerable-version finding, proof-of-concept reference, or static IOC.

·        The core sequence is analytically clear: public-facing Joomla site discovery, Joomla extension upload or import abuse, PHP-like artifact placement, web-accessible PHP execution, credential and configuration access, CMS state manipulation, outbound communication, hosted-content abuse, and post-remediation containment validation.

·        Detection opportunities are strong where Joomla asset inventory, extension inventory, URI-preserving web telemetry, WAF logs, reverse-proxy logs, CDN logs, load-balancer logs, file telemetry, endpoint telemetry, CMS state, DNS logs, proxy logs, firewall logs, FTP records, hosting-control records, backup comparison, malware scan results, abuse-desk records, change-control records, and business context can be correlated.

·        Defensive controls can be mapped directly to exposure governance, extension remediation, upload restriction, writable-path control, PHP execution restriction, webroot integrity monitoring, CMS state review, credential protection, outbound monitoring, hosting-control review, hosted-content validation, SOC triage, and incident-response containment.

·        Blocks 2, 3, 4, and 5 remain aligned while preserving a behavior-led model and avoiding actor-only, scanner-only, IOC-only, payload-only, exploit-string-only, or single-CVE-only overreach.

Maturity Gaps

·        Joomla asset inventory may not reliably identify public Joomla sites, customer-managed deployments, virtual hosts, backend hosts, shared-hosting accounts, cloud workloads, containerized workloads, business owners, hosted-content owners, or public exposure state.

·        Joomla extension inventory may not reliably identify JCE, SP Page Builder, Page Builder CK, editor extensions, page-builder extensions, media managers, asset uploaders, icon or font handlers, profile import functions, AJAX upload paths, archive extraction behavior, or component-owned writable paths.

·        Web, WAF, reverse-proxy, CDN, and load-balancer telemetry may not preserve enough URI path, query string, method, status, response size, request size, source IP, forwarded source IP, user agent, content type, extension route, upload behavior, or timestamp detail for complete reconstruction.

·        File telemetry may not preserve sufficient creation, modification, rename, write, read, delete, ownership, permission, timestamp, hash, or path detail across Joomla webroots and writable directories.

·        Endpoint telemetry may not preserve sufficient process lineage, command line, web server service context, sensitive-file access, database access, tool use, or rare egress behavior.

·        CMS administrative and database telemetry may not preserve sufficient administrator, Super User, editor profile, page-builder asset, upload policy, template, plugin, redirect, .htaccess, mail script, scheduled task, or content-change detail.

·        DNS, proxy, firewall, NDR, EDR network, and hosting-provider egress telemetry may not reliably connect outbound behavior to the affected Joomla site, backend host, virtual host, container, shared-hosting account, or workload identity.

·        FTP, file-manager, hosting-control, backup, malware scan, and abuse-desk records may be limited, provider-controlled, inconsistently retained, or disconnected from Joomla asset and business-owner context.

·        Help desk, incident-response, SOAR, vulnerability-management, hosting-provider, and remediation records may not consistently document extension remediation, PHP execution restriction, credential rotation, administrator review, content restoration, abuse-provider response, or post-remediation validation.

·        Business workflow baselines for Joomla administrators, hosting-provider support, deployment activity, media uploads, template changes, backups, migrations, vulnerability validation, malware cleanup, emergency remediation, and incident-response activity may be insufficient for false-positive control.

·        Organizations may over-rely on patch status, scanner alerts, vulnerable-extension names, public exploit reporting, single source IPs, suspicious PHP filenames, or abuse complaints rather than validating the full Joomla request-to-impact sequence.

Maturity Improvement Priorities

·        Normalize Joomla asset inventory, public exposure mapping, extension inventory, upload-capable extension mapping, writable-path mapping, PHP execution state, virtual-host mapping, backend-host mapping, hosting model, business ownership, content ownership, and hosted-content sensitivity.

·        Improve web logging, WAF logging, reverse-proxy logging, CDN logging, load-balancer logging, URI preservation, query-string retention, source-IP preservation, response metadata, upload behavior capture, extension route mapping, and timestamp normalization.

·        Improve file telemetry, webroot integrity monitoring, backup comparison, malware scan integration, known-good baseline management, PHP-like artifact detection, template integrity monitoring, plugin integrity monitoring, and .htaccess change detection.

·        Improve endpoint process telemetry, command-line telemetry, web server service-context mapping, sensitive-file access visibility, database access visibility, outbound process attribution, and Joomla host tagging.

·        Improve CMS state visibility for administrators, Super Users, editor profiles, page-builder assets, media libraries, upload policies, templates, plugins, modules, components, redirects, mail scripts, scheduled tasks, and content records.

·        Improve DNS, proxy, firewall, NDR, EDR network, FTP, hosting-control, file-manager, backup, abuse-desk, search-engine warning, malware scan, spam complaint, phishing report, customer report, and partner report correlation.

·        Improve remediation evidence capture for extension remediation, Joomla patch validation, PHP execution restriction, writable-path review, webroot cleanup, credential rotation, administrator review, database review, configuration-file review, outbound review, hosting-provider coordination, content restoration, and post-remediation monitoring.

·        Improve baselines for Joomla administration, extension updates, media uploads, template changes, plugin changes, backups, migrations, vulnerability validation, malware scanning, hosting-provider support, emergency remediation, incident-response cleanup, deployment workflows, and approved outbound destinations.

·        Add Joomla extension exploitation validation steps to SOC, web administration, hosting-provider coordination, vulnerability management, incident response, legal, compliance, privacy, cyber-insurance, communications, business-continuity, content-owner, application-owner, and executive reporting workflows.

Maturity Outlook

Maturity can improve quickly if the organization prioritizes Joomla asset inventory completeness, extension inventory completeness, upload-capable extension mapping, public exposure validation, URI and query-string retention, webroot integrity monitoring, writable-path PHP execution restriction, endpoint telemetry coverage, CMS state review, credential exposure review, outbound monitoring, hosting-control review, abuse-desk integration, business-workflow baselining, and SOC workflows that connect Joomla request behavior to file, execution, CMS, outbound, hosting-control, and hosted-content evidence. The highest-value improvements are Joomla asset ownership, extension ownership, writable-path governance, PHP execution restriction, webroot integrity baselines, administrator-state validation, credential rotation readiness, hosting-provider visibility, and post-remediation containment correlation.

S37 — Strategic Defensive Improvements

Strategic improvement should reduce the likelihood that attackers can use exposed Joomla extension functionality, weak upload controls, writable web paths, PHP execution, credential material, CMS administrator state, hosted content, outbound communication, or hosting workflows to create credential, content, abuse-infrastructure, containment, or business-continuity uncertainty without detection. The objective is measurable Joomla request-to-impact resilience and public web trust governance, not patch response alone.

Priority One — Establish Public Joomla Web Trust as a Security Metric

·        Define measurable assurance metrics for Joomla asset inventory completeness, extension inventory completeness, public exposure mapping, upload-capable extension mapping, URI and query-string retention, webroot integrity coverage, writable-path PHP execution restriction, administrator-state validation, credential exposure review, hosted-content validation, hosting-control visibility, abuse-desk visibility, and post-remediation monitoring.

·        Track resilience completeness for Joomla environments supporting customer portals, partner workflows, regulated content, payment-adjacent pages, public downloads, support portals, executive communications, marketing campaigns, high-traffic pages, shared hosting, reused credentials, and business-critical web delivery.

·        Report unresolved Joomla exposure, unknown extension state, weak upload governance, writable-path PHP execution, incomplete query-string logging, weak webroot integrity monitoring, limited endpoint visibility, weak administrator baselines, hosting-control visibility gaps, hosted-content visibility gaps, and post-remediation uncertainty as enterprise risk.

·        Treat unexplained Joomla extension activity, PHP-like file placement, webshell access, credential-file access, administrator changes, outbound communication, hosted-content tampering, abuse complaints, or post-remediation activity affecting high-value web properties as executive-relevant public web trust issues.

Priority Two — Harden Joomla Exposure, Extension, Upload, and Writable-Path Governance

·        Maintain live inventory of public Joomla sites, customer-managed deployments, virtual hosts, backend hosts, shared-hosting accounts, cloud workloads, upload-capable extensions, extension versions, writable paths, PHP execution state, public endpoints, hosting providers, administrator owners, business owners, content owners, and hosted-content sensitivity.

·        Enforce emergency extension remediation, vulnerable extension removal, Joomla patch validation, upload restrictions, PHP execution restrictions, source restrictions for administration, role-based administration, administrator MFA where supported, FTP restrictions, hosting-control restrictions, file-manager restrictions, and change-control validation by business criticality and hosted-content sensitivity.

·        Harden editor profiles, page-builder assets, media handling, image upload behavior, icon and font handling, profile import behavior, archive extraction behavior, AJAX upload behavior, component-owned writable paths, template editing, plugin modification, redirect management, and .htaccess changes.

·        Validate that Joomla administration can distinguish approved extension updates, media uploads, template changes, backups, migrations, vulnerability validation, hosting-provider support, emergency remediation, malware cleanup, and incident response from attacker-relevant access.

·        Reduce broad or informal exceptions that allow high-value Joomla sites or sensitive web properties to remain exposed to unnecessary public access, weak upload controls, writable-path PHP execution, incomplete logging, or unresolved extension state.

Priority Three — Improve Joomla Request, File, Execution, and CMS Visibility

·        Centralize WAF logs, reverse-proxy logs, CDN logs, load-balancer logs, web access logs, Joomla administrative records, CMS database records, file telemetry, endpoint telemetry, DNS logs, proxy logs, firewall logs, FTP records, hosting-control records, backup comparison data, malware scan results, abuse-desk records, vulnerability-management data, change-control records, and remediation evidence.

·        Improve telemetry that links suspicious Joomla extension activity to upload behavior, PHP-like artifact placement, HTTP access to planted files, web server service-context execution, credential-file access, CMS state changes, outbound communication, hosting-control activity, hosted-content impact, and post-remediation access.

·        Prioritize detection for suspicious Joomla extension upload or import behavior followed by PHP-like file placement, writable-path PHP access, web server process execution, sensitive-file access, administrator change, rare egress, FTP activity, hosting-control activity, hosted-content tampering, or continued access after remediation.

·        Validate timestamp normalization, field mapping, schema mapping, lookup accuracy, enrichment quality, exception logic, asset tagging, virtual-host mapping, extension-route mapping, writable-path mapping, source-IP preservation, and SIEM correlation before promoting hunt logic into high-severity alerting.

·        Require staged containment review for Joomla sites with unresolved PHP-like artifact placement, suspicious webshell access, credential-file access, administrator changes, hosted-content changes, outbound communication, or post-remediation activity.

Priority Four — Strengthen Credential, Administrator, Hosting-Control, and Content Controls

·        Improve visibility into Joomla administrator accounts, Super User accounts, CMS sessions, editor profiles, page-builder assets, media library state, upload policy state, extension configuration, templates, plugins, redirects, .htaccess rules, mail scripts, scheduled tasks, cron entries, and content records.

·        Improve credential protection for configuration.php, database credentials, database dumps, backup archives, environment files, FTP material, mail settings, API keys, deployment secrets, reused credentials, administrator credentials, and hosting-control credentials.

·        Improve hosting-control visibility into FTP activity, SFTP activity, file-manager activity, hosting-control panel access, backup jobs, restore jobs, mail configuration changes, DNS changes, domain changes, provider malware detections, provider suspensions, and abuse-provider actions.

·        Define rapid response paths for administrator review, Super User review, credential rotation, database review, configuration-file review, FTP review, hosting-control review, backup comparison, content restoration, abuse-desk remediation, legal review, compliance review, cyber-insurance engagement, communications planning, and executive reporting.

·        Prioritize sites and workflows involving customer portals, partner access, regulated content, payment-adjacent activity, public downloads, support workflows, executive communications, marketing campaigns, high-traffic pages, shared hosting, reused credentials, and adjacent web properties.

Priority Five — Improve Source-Enrichment, Egress, Abuse, and Post-Remediation Correlation

·        Enrich WAF, firewall, proxy, DNS, NDR, reverse-proxy, CDN, load-balancer, endpoint-adjacent, hosting-provider, and abuse-desk telemetry with Joomla site identity, virtual host, backend host, extension context, source reputation, ASN, geography, network type, request path, response metadata, destination context, hosted-content context, business owner, and approved workflow status.

·        Monitor suspicious source activity and egress after abnormal Joomla extension requests, PHP-like file placement, HTTP access to planted files, web server execution, credential-file access, CMS state changes, hosting-control activity, hosted-content tampering, or post-remediation activity.

·        Restrict outbound access from Joomla hosts to approved update destinations, hosting-provider destinations, backup destinations, monitoring destinations, CDN services, analytics services, mail services, and documented business integrations where feasible.

·        Prevent network-only detections from asserting Joomla exploitation, webshell execution, credential exposure, command-and-control, data theft, hosted-content compromise, or containment failure without Joomla request, file, execution, CMS state, hosting-control, hosted-content, remediation, or workflow correlation.

·        Treat continued PHP artifact access, outbound communication, administrator changes, hosting-control activity, hosted-content tampering, abuse reports, or suspicious file access after remediation as containment-validation failure until proven otherwise.

Priority Six — Strengthen SOC, Web, Hosting, Legal, and Executive Response

·        Create or update playbooks for suspicious Joomla extension activity, upload or import abuse, PHP-like file placement, web-accessible PHP execution, credential-file access, CMS state changes, administrator changes, outbound communication, FTP activity, hosting-control activity, hosted-content tampering, abuse complaints, and post-remediation activity.

·        Require responders to validate affected Joomla site, extension, route, source IP, ASN, geography, request path, query string, response behavior, uploaded path, file state, webroot integrity, endpoint execution, credential exposure, CMS state, administrator state, hosted content, business owner, data sensitivity, and remediation status.

·        Require rapid decision paths for emergency extension removal, Joomla patching, exposure reduction, PHP execution restriction, credential rotation, administrator review, database review, configuration-file review, hosting-provider escalation, abuse-desk remediation, content restoration, legal and compliance escalation, cyber-insurance coordination, communications planning, customer or partner notification analysis, and executive reporting.

·        Require Joomla webshell validation before affected sites resume unrestricted public web, customer portal, partner workflow, regulated content, payment-adjacent, public download, support, executive communication, or high-visibility brand functions.

·        Require post-event review to determine whether the organization can prove that Joomla activity was approved operational activity rather than suspicious follow-on behavior.

Strategic Outcome

The organization should be able to prove whether suspicious Joomla activity affected webshell execution, credential exposure, administrator state, CMS integrity, outbound communication, hosting-control access, hosted-content integrity, abuse infrastructure, customer-facing trust, partner workflows, regulated content, or post-remediation access. It should also be able to scope exposure across Joomla site, extension, upload route, writable path, PHP artifact, webroot, backend host, virtual host, administrator, credential source, outbound destination, hosting-control action, hosted-content item, business owner, remediation action, change-control record, and business workflow context, then restore public web trust, credential confidence, CMS integrity, hosted-content confidence, hosting-control assurance, and business continuity before Joomla extension exploitation becomes broad operational disruption.

S38 — Attack Economics & Organizational Impact Model

Figure 7

Joomla extension exploitation attack economics model showing how exposed public CMS functionality can create webshell execution uncertainty, credential exposure risk, hosted-content trust loss, abuse-infrastructure cost, post-remediation containment burden, and executive public-web trust restoration.

Joomla extension exploitation and unauthenticated PHP webshell execution changes the economics of intrusion response by allowing adversaries to pressure public web infrastructure that may support customer-facing websites, partner workflows, marketing operations, lead generation, public downloads, support portals, regulated content, e-commerce-adjacent activity, executive communications, shared hosting, database access, FTP access, mail settings, and business-critical web delivery. When suspicious Joomla extension activity, upload or import behavior, PHP-like file placement, web-accessible execution, credential-file access, CMS state change, outbound communication, hosting-control activity, hosted-content tampering, or post-remediation activity aligns inside one investigation window, the attacker can create disproportionate business uncertainty without compromising every endpoint, user account, application, or internal system individually.

The organization’s cost expands when responders must prove whether Joomla extension activity remained routine administration, whether upload or import behavior allowed attacker-controlled file placement, whether PHP-like artifacts were executable, whether webshell access occurred, whether configuration or credential files were accessed, whether administrator or Super User state changed, whether outbound communication reflected abuse infrastructure, whether hosted content was altered, whether credentials or adjacent web properties were affected, and whether public Joomla services can safely remain online after remediation.

Adversary Economic Advantage

·        Joomla extension exploitation can reduce attacker friction because public Joomla sites often expose upload, import, profile, media, image, asset, icon, font, page-builder, or AJAX functionality directly to the internet.

·        Unauthenticated or weakly controlled extension behavior can create a path from public web requests into attacker-controlled upload state without requiring employee endpoint compromise, phishing success, VPN access, or prior internal foothold.

·        PHP-like file placement in web-accessible Joomla paths can give adversaries a low-cost path to webshell execution, credential access, hosted-content manipulation, outbound communication, persistence, or abuse infrastructure.

·        Public Joomla sites give adversaries scalable access to high-value web trust surfaces that may be reachable from cloud-hosted infrastructure, VPN providers, residential proxies, scanner infrastructure, compromised hosts, or automated exploit tooling.

·        Normal Joomla administration, extension updates, media uploads, template changes, backups, migrations, vulnerability validation, hosting-provider support, malware scanning, emergency remediation, and incident-response cleanup can make attacker-driven behavior harder to classify quickly.

·        A single affected Joomla site supporting customer portals, partner workflows, regulated content, payment-adjacent pages, public downloads, support portals, executive communications, marketing campaigns, or high-traffic brand pages can create disproportionate business impact if webshell execution, credential exposure, or hosted-content tampering cannot be ruled out.

·        The attacker benefits when defenders cannot quickly determine whether Joomla request activity, file changes, CMS state, outbound communication, hosting-control activity, hosted-content changes, or post-remediation access were legitimate operational activity or adversary-driven exploitation.

·        Downstream impact can extend into emergency extension remediation, PHP execution restriction, webroot integrity review, credential rotation, administrator review, database review, configuration-file review, outbound investigation, hosting-provider escalation, abuse-desk response, legal assessment, compliance review, cyber-insurance coordination, communications planning, executive reporting, and public-web trust restoration.

Defender Cost Expansion

·        The organization must investigate both suspicious Joomla activity and the reliability of the asset, extension, web, WAF, reverse-proxy, CDN, load-balancer, file, endpoint, CMS, DNS, proxy, firewall, FTP, hosting-control, backup, malware scan, abuse-desk, remediation, and business-workflow evidence needed to confirm or disprove impact.

·        Response teams may need to reconstruct exposed Joomla asset state, affected extension usage, suspicious request sequences, upload behavior, archive extraction behavior, PHP-like file creation, web access to planted artifacts, web server execution, credential-file access, CMS state changes, outbound communication, hosted-content impact, and post-remediation behavior.

·        Mitigation may require emergency extension removal, Joomla patching, vulnerable extension remediation, PHP execution restriction, writable-path review, webroot cleanup, credential rotation, database review, administrator review, Super User review, hosting-provider coordination, content restoration, legal and compliance review, cyber-insurance support, communications planning, and executive assurance.

·        Internal exposure scoping may be required across affected Joomla sites, virtual hosts, backend hosts, shared-hosting accounts, databases, FTP accounts, administrator accounts, Super User accounts, templates, plugins, components, modules, mail settings, backup repositories, adjacent web properties, customer workflows, and partner workflows.

·        Response cost increases when Joomla asset inventory, extension inventory, URI and query-string logging, file telemetry, endpoint telemetry, CMS state records, FTP records, hosting-control logs, backup comparison, malware scan results, abuse-desk records, change-control records, or credential rotation evidence are incomplete.

·        Business impact increases when defenders must prove whether PHP execution occurred, whether credentials were exposed, whether administrator control changed, whether hosted content was altered, whether phishing or malware hosting occurred, whether spam infrastructure was staged, whether adjacent web properties were affected, and whether public-facing web services can safely continue.

Organizational Impact Model

Public Web Trust Impact

The organization must determine whether public Joomla sites were exposed, affected, vulnerable, misconfigured, reachable from the internet or partners, tied to high-value web workflows, or positioned in customer-facing, partner-facing, regulated, brand-sensitive, payment-adjacent, support, marketing, public download, or business-critical web delivery roles during the event window.

Extension Upload and Writable-Path Impact

The organization must determine whether Joomla extension upload, import, profile, custom-icon, asset, media, image, archive extraction, library, or AJAX behavior reflected normal administration, vulnerability validation, hosting-provider support, or exploit-relevant attacker-controlled file placement into web-accessible paths.

Webshell Execution and Runtime Impact

The organization must determine whether PHP-like artifacts were only present, whether they were accessed over HTTP, whether they executed in web server service context, whether command-like parameters appeared, whether web server child processes occurred, whether sensitive files were touched, and whether the activity represented actual webshell use rather than inert file placement or benign maintenance.

Credential and Configuration Impact

The organization must determine whether configuration.php, database credentials, database dumps, backup archives, environment files, FTP material, mail settings, API keys, deployment secrets, reused credentials, administrator credentials, or other credential-bearing material were accessed, copied, exposed, rotated, or reused after suspicious Joomla activity.

CMS State and Administrator Impact

The organization must determine whether administrator accounts, Super User accounts, editor profiles, page-builder assets, media library state, upload policy state, extension configuration, templates, plugins, redirects, .htaccess rules, mail scripts, cron entries, scheduled tasks, modules, components, or content records changed after suspicious extension activity or outside approved administration.

Hosted-Content and Abuse-Infrastructure Impact

The organization must determine whether public content, customer portals, partner-facing pages, regulated content, payment-adjacent pages, public downloads, support pages, marketing pages, executive communications, redirects, phishing pages, malware-hosting paths, spam scripts, SEO poisoning, unauthorized files, or browser and search-engine trust indicators were affected.

Containment and Public-Web Trust Restoration Impact

The organization must restore public-web trust, credential confidence, CMS integrity, hosted-content integrity, hosting-control assurance, and business continuity through extension remediation, Joomla patch validation, PHP execution restriction, writable-path review, webroot cleanup, credential rotation, administrator review, database review, outbound review, hosting-provider coordination, abuse-desk remediation, content restoration, legal review, compliance assessment, cyber-insurance coordination, executive reporting, and post-remediation monitoring.

Governance Impact

Leadership may need to treat confirmed or strongly suspected Joomla extension exploitation and PHP webshell execution as an executive-level public web trust incident because affected sites can support customer portals, partner workflows, regulated content, payment-adjacent activity, public downloads, support services, executive communications, marketing operations, high-traffic brand pages, shared hosting, reused credentials, adjacent web properties, and business-critical web delivery.

Economic Impact Summary

Joomla extension exploitation is economically powerful for adversaries because it can convert exposed CMS functionality into webshell execution, credential exposure, hosted-content manipulation, abuse infrastructure, and containment uncertainty. The organization’s financial exposure grows when it cannot quickly prove whether Joomla activity remained contained, whether PHP-like artifacts executed, whether credentials or configuration files were exposed, whether administrator or Super User state changed, whether hosted content was altered, whether the site was used for phishing, malware hosting, spam, or redirects, whether adjacent web properties were affected, and whether public Joomla services can safely continue.

S39 — Economic Impact & Organizational Exposure

Joomla extension exploitation and unauthenticated PHP webshell execution expands the organizational exposure model by increasing uncertainty around whether public CMS infrastructure was used for unauthenticated upload abuse, profile import abuse, custom-icon upload abuse, archive extraction, AJAX upload behavior, PHP-like file placement, web-accessible execution, credential or configuration access, CMS state manipulation, outbound communication, hosted-content tampering, abuse infrastructure, persistence, or post-remediation access. The exposure aligns with the report’s established behavior model because the core business risk is not limited to one extension name; it is whether trusted public Joomla functionality can be exploited and then used to place executable PHP content, access sensitive files, modify CMS state, alter hosted content, communicate externally, or create uncertainty over public web trust.

Economic exposure rises when suspicious Joomla activity involves exposed public sites, upload-capable extensions, editor profile import behavior, page-builder upload behavior, custom-icon upload behavior, AJAX upload behavior, file-management abuse, component-owned writable paths, media directories, image directories, temporary directories, cache paths, iconfont paths, gfonts paths, templates, plugins, modules, components, configuration.php, database credentials, FTP material, mail settings, API keys, administrator accounts, Super User accounts, hosted content, partner workflows, customer portals, public downloads, or business-critical web services. Exposure is highest when suspicious request activity cannot be separated from PHP-like file placement, HTTP access to planted artifacts, web server service-context execution, sensitive-file access, CMS state change, outbound communication, hosting-control activity, hosted-content impact, or post-remediation activity.

Estimated Economic Exposure

Estimated exposure should be treated as scenario-based rather than fixed. The most defensible enterprise estimate is tied to whether activity remains limited to scanning, probing, denied upload attempts, exposed-version findings, isolated suspicious requests, or patch validation; becomes suspected or confirmed Joomla extension exploitation; or expands into PHP-like file placement, webshell execution, credential-file access, administrator manipulation, hosted-content tampering, outbound communication, abuse infrastructure, persistence, adjacent web property exposure, or loss of confidence in public website integrity.

Economic exposure increases when the organization cannot quickly prove whether Joomla extension activity remained limited to attempted exploitation, whether unauthenticated upload or import behavior occurred, whether attacker-controlled files reached web-accessible paths, whether PHP-like artifacts executed, whether configuration or credential files were accessed, whether administrator or Super User state changed, whether hosted content was modified, whether outbound communication occurred, whether abuse-provider or customer reports indicate public impact, and whether web, WAF, reverse-proxy, CDN, load-balancer, file, endpoint, CMS, DNS, proxy, firewall, FTP, hosting-control, backup, malware scan, abuse-desk, and remediation telemetry can be joined into a reliable sequence.

Low Impact Scenario

Estimated $350K - $2.8M

This scenario applies when suspicious Joomla extension upload or import activity, exposed extension findings, scanner activity, malformed requests, denied upload attempts, abnormal request paths, or isolated upload-handler errors are detected quickly, but available telemetry confirms no PHP-like file placement, no webshell access, no web server service-context execution, no credential-file access, no administrator or Super User changes, no outbound communication, no FTP activity, no hosting-control abuse, no hosted-content tampering, no phishing pages, no malware hosting, no spam infrastructure, and no post-remediation activity. Response remains limited to targeted extension remediation, Joomla exposure review, evidence preservation, webroot inspection, PHP execution validation, administrator review, credential precaution, short-term monitoring, and executive tracking.

Moderate Impact Scenario

Estimated $3.5M - $18M

This scenario applies when confirmed or strongly suspected Joomla extension exploitation affects one or more public Joomla sites, extension-owned paths, writable directories, media paths, image paths, iconfont paths, gfonts paths, component-owned paths, administrator workflows, FTP workflows, or hosted-content workflows, but available evidence does not confirm broad data theft, multi-site compromise, or business-critical service disruption. The organization cannot immediately determine whether suspicious requests led to PHP-like file placement, web-accessible PHP execution, credential-file access, database access, configuration-file exposure, administrator or Super User manipulation, outbound communication, hosted-content modification, phishing pages, malware hosting, spam infrastructure, or persistence. Response may require web and WAF record reconstruction, extension inventory validation, webroot integrity review, file and database inspection, credential rotation, administrator and Super User review, outbound traffic analysis, hosting-provider coordination, content review, abuse-desk handling, legal and compliance review, cyber-insurance coordination, executive reporting, and strengthened monitoring for post-remediation activity.

High Impact Scenario

Estimated $22M - $95M+

This scenario applies when Joomla extension exploitation becomes an enterprise-impact event involving confirmed or strongly suspected PHP webshell execution, credential exposure, database access, administrator compromise, malicious redirects, phishing pages, malware hosting, spam infrastructure, customer-facing content tampering, partner workflow exposure, regulated data concern, multi-site compromise, or persistent attacker access through webroot, CMS, FTP, hosting-control, or reused credentials. The upper end of this range applies when the organization must assume that customer-facing services, public content, regulated information, website credentials, database material, administrator accounts, partner workflows, hosting environments, adjacent web properties, or shared backend infrastructure were affected until audit evidence proves otherwise. Response may require extended web forensics, broad credential rotation, database and configuration review, backup comparison, content restoration, malicious artifact removal, hosting-provider escalation, abuse-desk remediation, customer or partner notification analysis, legal and privacy escalation, cyber-insurance engagement, communications planning, executive and board reporting, and formal validation that Joomla sites and dependent web services can safely remain online.

Annualized Risk Exposure

Estimated $3.5M - $22M+ for materially exposed enterprise environments with public Joomla sites, vulnerable or weakly controlled extensions, customer-facing or partner-facing workflows, sensitive hosted content, incomplete query-string logging, weak webroot integrity monitoring, limited endpoint visibility, shared hosting constraints, unclear writable-path controls, incomplete Joomla extension inventory, weak outbound monitoring, incomplete FTP or hosting-control logs, or poor administrator activity baselines.

Exposure may exceed $22M - $95M+ where Joomla extension exploitation results in confirmed or suspected PHP webshell execution, credential exposure, database access, administrator compromise, malicious redirects, phishing pages, malware hosting, spam infrastructure, customer-facing integrity loss, regulated data concern, multi-site compromise, incomplete containment, cyber-insurance review, legal escalation, communications response, or board-level reporting.

Management-Platform Dependency

Management-platform dependency is high where Joomla administration, extension management, media handling, page-builder workflows, FTP access, file-manager access, hosting-control panels, backup systems, deployment workflows, malware scanning, content publishing, and provider-side support are used to manage public web properties. Dependency increases when affected Joomla sites connect to shared databases, reused credentials, mail systems, DNS settings, CDN services, analytics services, customer portals, partner workflows, regulated content, payment-adjacent workflows, public download paths, or adjacent virtual hosts that cannot be easily isolated without business disruption.

Control-Plane Trust

Control-plane trust is reduced when the organization cannot prove that Joomla administrator state, Super User state, extension configuration, upload policy, writable-path control, PHP execution restrictions, webroot integrity, template state, plugin state, redirect state, .htaccess rules, FTP access, hosting-control activity, backup state, and content publishing remained reliable during the activity window.

Control-plane trust is further reduced when suspicious extension requests, upload activity, PHP-like file placement, HTTP access to planted files, sensitive-file access, outbound communication, administrator changes, FTP activity, hosting-control activity, hosted-content changes, or telemetry gaps cannot be tied to approved maintenance, approved Joomla administration, approved extension updates, approved media uploads, approved vulnerability validation, approved hosting-provider support, approved malware cleanup, or validated incident-response activity.

Visibility Confidence

Visibility confidence is highest when WAF logs, reverse-proxy logs, CDN logs, load-balancer logs, web access logs, URI paths, query strings, Joomla administrative records, CMS database records, file telemetry, endpoint telemetry, process lineage, web server service-context telemetry, DNS logs, proxy logs, firewall logs, FTP records, hosting-control logs, backup comparison data, malware scan results, abuse-desk records, asset inventory, extension inventory, administrator records, and change-control records can be joined reliably.

Visibility confidence is reduced when web logs do not preserve query strings, request bodies, upload filenames, multipart metadata, source context, forwarded source IPs, response sizes, or virtual-host mapping; when Joomla administrative logs are absent; when CMS state requires manual database inspection; when file telemetry does not cover media, images, tmp, cache, uploads, assets, iconfont, fonts, gfonts, templates, plugins, components, modules, libraries, or extension-owned paths; when endpoint telemetry does not cover Joomla hosts; when outbound telemetry cannot distinguish approved Joomla activity from suspicious communication; or when timestamps and change records are insufficient to reconstruct the request-to-impact sequence.

Privileged Object Confidence

Privileged object confidence is high when Joomla administrator accounts, Super User accounts, extension configuration, editor profiles, page-builder assets, media library state, upload policy state, templates, plugins, modules, components, redirects, .htaccess rules, mail scripts, scheduled tasks, cron entries, configuration.php, database credentials, database dumps, backup archives, environment files, FTP material, mail settings, API keys, deployment secrets, and administrator credential material can be validated against approved baselines.

Confidence is reduced when suspicious activity occurs outside approved windows, lacks an owning ticket, creates or modifies administrator accounts, changes Super User state, modifies upload policy, changes extension state, touches configuration or credential files, creates PHP-like artifacts, modifies templates or plugins, alters redirects or .htaccess rules, initiates outbound communication, accesses hosted content, or creates uncertainty around whether the action was performed by an expected administrator, hosting provider, deployment user, cleanup process, or incident-response workflow.

Connector and Credential Dependency

Connector and credential dependency is high when Joomla sites rely on database credentials, FTP credentials, hosting-control credentials, SSH credentials, mail credentials, API keys, deployment secrets, backup access, analytics integrations, CDN integrations, payment-adjacent workflows, partner workflows, or reused credentials. These dependencies increase the impact of even limited Joomla compromise because responders may need to prove that configuration files, credential material, database connections, mail settings, FTP workflows, hosting-control access, backup access, and downstream integrations remained intact.

Credential dependency becomes materially higher when configuration.php, database dumps, backup archives, environment files, FTP material, mail settings, API keys, administrator credentials, or reused credentials may have been accessed after suspicious upload behavior, PHP-like file placement, webshell access, CMS state manipulation, or outbound communication.

Downstream Device Dependency

Downstream device dependency is high when Joomla hosts, shared hosting accounts, backend web servers, databases, mail systems, FTP services, backup systems, storage services, CDN services, DNS services, monitoring systems, deployment systems, or adjacent virtual hosts depend on the affected Joomla environment. These dependencies increase scope because attackers may use exposed credential material, webshell execution, hosting-control access, FTP access, shared databases, reused credentials, or common deployment workflows to affect adjacent web properties or supporting infrastructure.

Downstream dependency should be interpreted conservatively because Joomla extension exploitation does not automatically prove lateral movement, cloud compromise, identity compromise, or database compromise. It becomes materially relevant when telemetry shows credential access, database access, FTP activity, hosting-control activity, shared-hosting activity, outbound communication, adjacent webroot access, or suspicious use of credentials connected to the affected Joomla site.

Customer, Workforce, and Regulatory Exposure

Customer, workforce, and regulatory exposure increases when suspicious Joomla extension activity, PHP-like file placement, webshell execution, credential-file access, database access, hosted-content tampering, phishing pages, malware hosting, spam infrastructure, malicious redirects, public downloads, partner workflow exposure, or regulated data concern affects customer-facing sites, partner-facing workflows, public portals, support portals, regulated content, payment-adjacent pages, executive communications, workforce-facing web services, or externally trusted web properties.

Exposure also increases when telemetry gaps prevent timely confirmation of whether hosted content, customer records, partner information, regulated data, credentials, database material, mail settings, public downloads, redirects, administrator actions, outbound communication, abuse-provider notifications, customer reports, partner reports, or adjacent web properties were impacted.

Residual Economic Risk

Residual economic risk remains after extension remediation, Joomla patching, PHP execution restriction, file cleanup, credential rotation, administrator review, hosting-provider coordination, content restoration, WAF tuning, or abuse-provider response when the pre-remediation activity window cannot be reconstructed. Updating affected extensions reduces future exposure, but it does not prove that pre-remediation upload abuse, PHP-like file placement, webshell execution, credential access, CMS state manipulation, outbound communication, hosted-content tampering, abuse infrastructure, or persistence did not occur.

Residual risk should remain elevated until historical WAF logs, reverse-proxy logs, CDN logs, load-balancer logs, web access logs, Joomla administrative records, CMS database records, file telemetry, endpoint telemetry, process telemetry, DNS logs, proxy logs, firewall logs, FTP logs, hosting-control logs, backup comparison data, malware scan results, abuse-desk records, change-control records, incident-response notes, remediation records, and business-owner evidence have been reviewed.

Proof-of-Concept / KEV Behavioral Coverage Assessment

This report’s behavioral detection model directly covers the Joomla extension exploitation CVEs represented by the report because observable activity aligns with the primary public CMS compromise chain: unauthenticated extension upload or import behavior, attacker-controlled upload state, PHP-like file placement, web-accessible execution, webshell access, credential or configuration access, CMS state manipulation, outbound communication, hosted-content abuse, and containment validation.

The model directly covers CVE-2026-56290 where Page Builder CK browse.ajaxAddPicture or similar AJAX upload behavior results in attacker-controlled file placement, executable upload, PHP-like artifact creation, web-accessible file creation, command execution, credential access, outbound communication, hosted-content tampering, or post-remediation integrity concern.

The model directly covers CVE-2026-48939 where iCagenda event-submission or attachment behavior results in unauthenticated arbitrary file upload, PHP webshell placement, executable PHP access, remote code execution, hosted-content impact, outbound communication, or post-remediation integrity concern.

The model directly covers CVE-2026-48908 where SP Page Builder asset.uploadCustomIcon or similar custom-icon upload behavior results in archive upload, extracted PHP-like content, webroot or extension-owned file placement, web-accessible execution, webshell access, credential access, outbound communication, hosted-content tampering, or abuse infrastructure.

The model directly covers CVE-2026-48907 where Joomla Content Editor profile import or editor-profile abuse results in attacker-controlled profile state, executable upload enablement, arbitrary PHP upload, webshell execution, credential access, CMS state manipulation, outbound communication, hosted-content tampering, or post-remediation integrity concern.

The model directly covers CVE-2026-21628 where Astroid Framework file-management abuse allows unauthenticated upload of dangerous file types, remote code execution, PHP-like file placement, web-accessible execution, credential access, CMS state manipulation, outbound communication, or hosted-content impact.

The model directly covers CVE-2026-21627 where Tassos / Novarain Framework AJAX handling abuse through Joomla com_ajax can invoke restricted internal framework functionality and support file-read, SQL injection, arbitrary PHP inclusion, arbitrary file upload, arbitrary file delete, or RCE-relevant follow-on behavior when observable activity aligns with the report’s Joomla request-to-file or request-to-impact model.

The model provides coverage with adaptation for CVE-2026-49049 where Helix3 unauthenticated AJAX handler abuse allows arbitrary file deletion, arbitrary JSON write, and template-parameter modification. This maps to S25 CMS state, template, hosted-content, file-write, file-impact, and integrity monitoring logic, but should not be counted as direct PHP webshell execution coverage unless local evidence shows executable placement, PHP access, hosted-content impact, or follow-on abuse.

The model provides coverage with adaptation for CVE-2026-48906 where Tassos / Novarain Framework arbitrary file deletion affects Joomla file integrity and hosted-content trust. This maps to file-impact and CMS integrity coverage, but should not be counted as direct webshell or RCE coverage unless paired with Joomla request-to-file, execution, credential, outbound, hosted-content, or post-exploitation evidence.

Known exploitation, KEV status, public proof-of-concept availability, vendor reporting, scanner coverage, or KEV-style urgency should be treated as prioritization inputs, not compromise proof. Local compromise assessment must still be based on observable request activity, file behavior, web access, process behavior, CMS state, credential access, outbound communication, hosting-control activity, hosted-content evidence, and incident-response findings.

Detection Engineering Coverage Interpretation

The S25 detection content provides direct behavioral coverage when suspicious Joomla extension, upload, import, profile, custom-icon, media, image, asset, archive extraction, AJAX, PHP-like file, webshell, credential, CMS state, outbound, FTP, hosting-control, hosted-content, or post-remediation activity falls inside the report’s Joomla extension exploitation and PHP webshell execution model. Direct coverage applies because this report explicitly includes JCE profile import behavior, SP Page Builder custom-icon upload behavior, Page Builder CK AJAX upload behavior, iCagenda-style public file upload behavior, Astroid Framework file-management upload behavior, Tassos / Novarain AJAX framework abuse, Joomla writable-path PHP placement, web-accessible PHP execution, credential or configuration access, CMS state manipulation, outbound communication, hosted-content tampering, abuse infrastructure, and containment validation.

Detection coverage should be interpreted as behavior-led coverage, not CVE-string coverage. CVE identifiers, extension names, route names, request fragments, source IPs, user agents, scanner labels, proof-of-concept names, payload strings, filenames, malware names, actor names, campaign labels, or exploit labels should not be used as primary detection inputs unless they are locally approved enrichment supporting triage. Detection confidence remains based on observable request behavior, file behavior, process behavior, CMS behavior, outbound communication, hosting-control activity, hosted-content impact, administrator context, and change-control context.

PHP webshells, exploit scripts, proof-of-concept tooling, scanner logic, file names, route names, source infrastructure, payload strings, user agents, and webshell labels should be interpreted as behavior-led enrichment only. The report does not detect a named malware family directly. It detects the behavior that PHP webshells, exploit scripts, scanners, and upload-abuse tooling may produce when they interact with exposed Joomla extension functionality, create PHP-like artifacts, access planted files, execute in web server context, access configuration material, communicate externally, manipulate CMS state, or alter hosted content.

Actor, campaign, cybercrime, SEO spam, private blog network, gambling-affiliate, adult-affiliate, ransomware, initial-access, espionage, or webshell-operator coverage should be treated as enrichment and context only. The report does not detect actor names directly. It detects the behavior those actors, operators, affiliates, or toolchains may produce when abusing public Joomla extension infrastructure, upload handlers, editor profiles, page-builder functions, AJAX paths, writable directories, PHP execution paths, administrator state, hosted content, outbound communication, and abuse infrastructure. Current OSINT supports campaign-style exploitation and SEO / PBN monetization activity tied to Joomla JCE exploitation, including hidden backlink injection and affiliate-style monetization. This should be included as campaign enrichment, not as confirmed APT attribution.

Active exploitation, public reporting, proof-of-concept availability, vendor priority, scanner coverage, and KEV status should be treated as urgency and remediation-prioritization signals, not as detection coverage by themselves. KEV status increases urgency for CVE-2026-48907, CVE-2026-48908, and CVE-2026-56290, while public-exploit and exploitation-concern reporting increases urgency for the broader Joomla extension upload-abuse cluster. Local compromise assessment must still be based on observable request activity, file behavior, process behavior, CMS state, credential access, outbound communication, hosting-control activity, hosted-content evidence, and incident-response findings.

Direct Coverage

Direct coverage applies where observable activity aligns with the report’s Joomla compromise chain: unauthenticated extension upload or import abuse, profile import abuse, custom-icon upload abuse, AJAX upload abuse, archive extraction, file-management upload abuse, PHP-like file placement, web-accessible PHP execution, webshell access, credential or configuration access, CMS state manipulation, outbound communication, hosted-content tampering, abuse infrastructure, persistence, or containment failure.

·        CVE-2026-56290

·        CVE-2026-48939

·        CVE-2026-48908

·        CVE-2026-48907

·        CVE-2026-21628

·        CVE-2026-21627

The CVEs listed above should be counted as direct coverage because they fall inside the report’s explicit Joomla extension upload, import, AJAX, file-management, writable-path, PHP-like artifact, web-accessible execution, and webshell behavior model. The S21 through S25 detection strategy is designed to catch these behaviors through correlated request, file, execution, CMS state, outbound, hosting-control, hosted-content, and remediation evidence rather than through CVE strings alone.

Coverage With Adaptation

Coverage with adaptation applies to related Joomla extension, CMS extension, PHP CMS, webroot, upload-handler, archive-extraction, media-manager, page-builder, editor-profile, asset-upload, image-upload, AJAX-upload, template-editing, plugin-modification, arbitrary-file-deletion, arbitrary-file-write, credential-read, webshell-adjacent, hosted-content, or abuse-infrastructure issues that are not direct PHP webshell upload or RCE matches but still produce behavior that can be mapped to the report’s detection model.

·        CVE-2026-49049

·        CVE-2026-48906

Coverage with adaptation requires local route mapping, extension inventory, path mapping, writable-path inventory, PHP execution validation, query-string retention, approved administrator baselines, hosting-provider baselines, and telemetry joins. These items should not be counted as direct coverage unless local telemetry shows Joomla-linked suspicious request activity, file placement, web access, execution behavior, sensitive-file access, CMS state change, outbound communication, hosted-content impact, or containment failure.

Non-Coverage Conditions

Non-coverage applies where related activity does not produce observable Joomla extension upload or import abuse, PHP-like file placement, web-accessible PHP execution, credential or configuration access, CMS state manipulation, outbound communication, hosted-content tampering, abuse infrastructure, persistence, or downstream impact.

Non-coverage applies when activity remains limited to vulnerable-version exposure, internet exposure, patch-state findings, scanner output, denied requests, isolated web errors, isolated PHP requests, generic webshell artifacts with no Joomla linkage, isolated administrator-path access, arbitrary file deletion without impact evidence, template parameter modification without hosted-content or CMS-state impact, or maintenance activity without supporting suspicious source context or downstream behavior.

Non-coverage also applies when required web logs, WAF logs, reverse-proxy logs, CDN logs, load-balancer logs, file telemetry, endpoint telemetry, process telemetry, Joomla administrative records, CMS database records, DNS logs, proxy logs, firewall logs, FTP records, hosting-control records, backup comparison data, malware scan results, abuse-desk records, change-control records, incident-response evidence, or SIEM telemetry are unavailable or cannot be joined reliably enough to support a coverage determination.

Activity should not be counted when it is better explained by approved Joomla administration, extension updates, media uploads, template changes, plugin changes, backups, migrations, malware scans, vulnerability validation, hosting-provider support, emergency remediation, content restoration, security testing, vulnerability management, or incident response.

Current Coverage Count

Directly covered CVEs: 6

·        CVE-2026-56290

·        CVE-2026-48939

·        CVE-2026-48908

·        CVE-2026-48907

·        CVE-2026-21628

·        CVE-2026-21627

CVEs covered with adaptation: 2

·        CVE-2026-49049

·        CVE-2026-48906

Known exploited / KEV-represented vulnerabilities in this S39 review: 3

·        CVE-2026-56290

·        CVE-2026-48908

·        CVE-2026-48907

Public exploit / exploitation-concern items requiring final publication QA: at least 1

·        CVE-2026-48939

Named malware / tooling / exploit-framework coverage: behavior-led PHP webshell and public exploit-tooling coverage, not a named malware-family count

Named actor / campaign coverage: SEO / PBN campaign enrichment tied to Joomla JCE exploitation reporting; no confirmed named APT attribution should be claimed

Total CVEs directly covered by this report’s behavioral detection model: 6

Total CVEs covered with adaptation by this report’s behavioral detection model: 2

Total CVEs represented in the corrected S39 coverage register: 8

Coverage Qualification

Coverage is strong for behaviorally visible Joomla extension exploitation where suspicious request activity can be joined with upload or import behavior, PHP-like file placement, HTTP access to planted artifacts, web server service-context execution, sensitive-file access, CMS state changes, administrator changes, outbound communication, FTP activity, hosting-control activity, hosted-content impact, abuse reports, or post-remediation activity.

Coverage is weaker for exposure-only vulnerable version state, isolated denied requests, isolated suspicious paths, arbitrary file deletion without impact evidence, template-parameter changes without hosted-content or CMS-state impact, ordinary Joomla administrator activity, approved extension updates, approved media uploads, approved template changes, approved hosting-provider support, approved security testing, patch validation, or environments where request, file, process, CMS, outbound, hosting-control, hosted-content, and change-management telemetry cannot be joined.

The report should not claim universal Joomla detection, universal CMS detection, universal PHP upload detection, universal webshell detection, universal arbitrary file deletion detection, universal data-exfiltration detection, universal KEV coverage, universal APT coverage, or standalone actor attribution. Detection confidence depends on telemetry completeness, field mapping, local baselines, Joomla asset inventory, extension inventory, request logging, query-string retention, file telemetry, endpoint visibility, outbound telemetry, CMS state visibility, FTP visibility, hosting-control records, abuse-desk records, change-control evidence, false-positive testing, query performance testing, and SOC triage readiness.

Executive Exposure Statement

The organization’s economic exposure is highest when Joomla extension exploitation creates uncertainty around whether public website infrastructure remained trustworthy. The strategic risk is not only that a vulnerable extension exists, that a scanner touched a Joomla endpoint, that a PHP-like file was found, or that a campaign label appears in OSINT; it is the possibility that attackers used exposed Joomla functionality to place executable content, run webshells, access credentials, alter CMS state, modify hosted content, create phishing or malware infrastructure, inject SEO / PBN content, communicate externally, or undermine confidence in customer-facing and partner-facing web services.

S40 — References

Vendor / Platform Documentation

·        Joomla Security Centre - hxxps://developer[.]joomla[.]org/security-centre[.]html

·        Joomla Extensions Directory - Joomla Content Editor - hxxps://extensions[.]joomla[.]org/extension/edition/editors/jce/

·        Joomla Extensions Directory - SP Page Builder - hxxps://extensions[.]joomla[.]org/extension/sp-page-builder/

·        Joomla Extensions Directory - Page Builder CK - hxxps://extensions[.]joomla[.]org/extension/page-builder-ck/

·        Joomla Extensions Directory - iCagenda - hxxps://extensions[.]joomla[.]org/extension/icagenda/

·        Astroid Framework - hxxps://astroidframe[.]work/

·        Tassos Framework / Novarain Framework - hxxps://www[.]tassos[.]gr/

·        JoomShaper Helix3 - hxxps://www[.]joomshaper[.]com/helix3

Threat Technique Framework

·        MITRE ATT&CK - hxxps://attack[.]mitre[.]org/

·        CISA Known Exploited Vulnerabilities Catalog - hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog

Security Vendor Analysis

·        NVD - CVE-2026-56290 - hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-56290

·        NVD - CVE-2026-49049 - hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-49049

·        NVD - CVE-2026-48939 - hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-48939

·        NVD - CVE-2026-48908 - hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-48908

·        NVD - CVE-2026-48907 - hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-48907

·        NVD - CVE-2026-48906 - hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-48906

·        NVD - CVE-2026-21628 - hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-21628

·        NVD - CVE-2026-21627 - hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-21627

Threat Tradecraft and Intrusion Patterns

·        YesWeHack - Unauthenticated RCE in the Joomla Content Editor Extension - hxxps://www[.]yeswehack[.]com/news/rce-joomla-content-editor-extension

·        Censys - SP Page Builder for Joomla Unauthenticated Arbitrary File Upload Advisory - hxxps://censys[.]com/advisory/cve-2026-48908/

·        IONIX - CVE-2026-48939 Unauthenticated File Upload RCE - iCagenda Extension for Joomla - hxxps://www[.]ionix[.]io/threat-center/cve-2026-48939/

·        Halo Security - CVE-2026-56290 Joomla Page Builder CK Arbitrary File Upload - hxxps://cve[.]halosecurity[.]com/cve-advisory/cve-2026-56290-joomla-page-builder-ck-arbitrary-file-upload

·        Astroid Framework - CVE-2026-21628 Security Update - hxxps://docs[.]astroidframe[.]work/security-update/CVE-2026-21628

·        mySites.guru - Novarain Framework Joomla Vulnerability - hxxps://mysites[.]guru/blog/novarain-framework-joomla-vulnerability/

·        IONIX - CVE-2026-49049 Helix3 Unauthenticated File Deletion and Arbitrary Write - hxxps://www[.]ionix[.]io/threat-center/cve-2026-49049/

·        Vulners - CVE-2026-48906 - hxxps://vulners[.]com/cve/CVE-2026-48906