Community Signatures

Community Signatures

Overview

The threat intelligence database can sync with community-contributed malware signatures hosted on GitHub. This extends your detection capabilities beyond what you've personally encountered.

Syncing Signatures

Download Latest Signatures

wp_threat_db_sync()

This downloads:

• community-signatures.json - Malware detection patterns (regex and string patterns)
• community-hashes.json - Known malicious file hashes (MD5/SHA256)

New signatures are merged into your local database without overwriting your custom additions.

Additional Feeds

Sync with external vulnerability databases:

# Patchstack vulnerability feed
wp_threat_sync_patchstack()

# WPScan vulnerability feed
wp_threat_sync_wpscan()

Checking Your Database

# View database statistics
wp_threat_db_stats()

# See most frequently triggered signatures
wp_threat_top_signatures()

# Generate a threat intelligence report
wp_threat_report()

Contributing Your Discoveries

After cleaning malware, your local database contains unique threat intelligence. Share it:

1. Export Your Signatures

wp_threat_export()

This generates a JSON file with your locally-added signatures and hashes.

2. Submit a Pull Request

1. Fork vapvarun/wp-malware-cleanup-mcp
2. Add your signatures to community-signatures.json or community-hashes.json
3. Include a description of what malware each signature detects
4. Submit the PR

Guidelines for Contributions

• Only submit confirmed malware signatures (no unverified patterns)
• Include clear descriptions of what the signature detects
• Test for false positives before submitting
• Do not include sensitive information (hostnames, IPs, client names)
• Anonymized case studies are welcome in docs/case-studies/

Manually Adding Signatures

Add a custom signature to your local database:

wp_threat_add_signature(
    name="my-custom-backdoor-pattern",
    pattern="specific_function_name.*suspicious_arg",
    pattern_type="regex",
    severity="high",
    category="backdoor",
    description="Detects the XYZ backdoor variant"
)

Checking a Specific File

Test a file against the full threat database:

wp_threat_check_file("site-name", "/path/to/suspicious/file.php")

This checks:

• File hash against known_malicious_files
• File content against all active signatures
• Returns match details if found