#malware

7 one-liners with this tag.

Check WordPress core files for tampering

$wp core verify-checksums --path=/var/www/vhosts/example.com/httpdocs

Compare plugin files with the originals from wordpress.org

$wp plugin verify-checksums --all --path=/var/www/vhosts/example.com/httpdocs

Find hidden PHP files in the web directory

$find /var/www/vhosts/example.com/httpdocs -type f -name '.*.php' -ls

harmlessSecurity

Find PHP files in the WordPress uploads folder

$find /var/www/vhosts/example.com/httpdocs/wp-content/uploads -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.php[0-9]' \) -ls

harmlessSecurity

Find processes whose executable was deleted

#ls -l /proc/*/exe 2>/dev/null | grep '(deleted)'

harmlessSecurity

Find recently modified PHP files

$find /var/www/vhosts/example.com/httpdocs -type f -name '*.php' -mtime -7 -printf '%TY-%Tm-%Td %TH:%TM %p\n' | sort -r

harmlessSecurity

Search PHP files for typical malware patterns

$grep -rlE --include='*.php' 'eval\((base64_decode|gzinflate|gzuncompress|str_rot13)\(' /var/www/vhosts/example.com/httpdocs

harmlessSecurity