This detection rule monitors inbound messages for links that are steered through compromised WordPress installations as an obfuscated path to an unrelated root-domain. It looks for URLs in the message body whose href_url.path matches WordPress access points (/wp-admin, /wp-includes, /wp-content), with a deliberate exclusion for the newsletter plugin's admin-ajax endpoint (to avoid false positives). If a link redirects via a history that ends at the root path (path '/'), where the destination domain root_domain differs from the original href_url.domain.root_domain, and there are no query parameters, and the destination subdomain is either absent or 'www', the rule triggers. This pattern indicates adversaries abusing compromised WordPress sites to mask the true target and evade standard detection. The lure content centers on urgent business actions to coerce clicking. Attack types: Credential Phishing, BEC/Fraud. TTPs: Open Redirect, Evasion, Social Engineering. Detection methods: URL analysis, Content analysis. Data Source: Network Traffic. Domain: Web.