Core Features
Detection Details
- Content signatures -- detects eval/base64 payloads, cookie-gated backdoors, c99/r57/WSO-style shells, stream-wrapper loading, chr-array decoding, and script injection.
- Extension registry cross-check -- cross-references Joomla's own
#__extensionstable to catch fake templates, modules, plugins, and components -- a harder-to-fake signal than filesystem structure alone. - Filename patterns -- matches known malware-drop naming, duplicate configuration files, random numeric drop folders, and suspicious top-level webroot items.
- JCE coverage -- applies tuned heuristics to
media/com_jce,administrator/components/com_jce,components/com_jce, andplugins/editors/jce. - Rogue users -- flags Super User accounts with attacker-pattern names or suspicious local email domains.
- Confidence scoring -- labels findings as High or Medium so administrators can prioritize review.
- Guided actions -- offers scoped delete, surgical menu params cleanup, rogue SPPB asset row deletion, and one-click false-positive dismissal.