Bundle

bundle.json

{
    "schema": 1,
    "version": "1.25.0",
    "tokens": {
        "eval": "eval",
        "assert": "assert",
        "create_function": "create_function",
        "shell_exec": "shell_exec",
        "system": "system",
        "passthru": "passthru",
        "proc_open": "proc_open",
        "popen": "popen",
        "pcntl_exec": "pcntl_exec",
        "exec": "exec",
        "base64_decode": "base64_decode",
        "gzinflate": "gzinflate",
        "gzuncompress": "gzuncompress",
        "gzdecode": "gzdecode",
        "str_rot13": "str_rot13",
        "convert_uudecode": "convert_uudecode",
        "hex2bin": "hex2bin",
        "rawurldecode": "rawurldecode"
    },
    "groups": {
        "eval_cf": [
            "eval",
            "create_function"
        ],
        "eval_assert": [
            "eval",
            "assert"
        ],
        "exec_sinks": [
            "eval",
            "assert",
            "create_function"
        ],
        "decoders": [
            "base64_decode",
            "gzinflate",
            "gzuncompress",
            "gzdecode",
            "str_rot13",
            "convert_uudecode",
            "hex2bin",
            "rawurldecode"
        ],
        "sinks_decoders": [
            "eval",
            "assert",
            "create_function",
            "base64_decode",
            "gzinflate",
            "gzuncompress",
            "gzdecode",
            "str_rot13"
        ],
        "sink_decoder_names": [
            "eval",
            "base64_decode",
            "assert",
            "gzinflate",
            "create_function",
            "str_rot13"
        ],
        "shell": [
            "shell_exec",
            "system",
            "passthru",
            "proc_open",
            "popen",
            "pcntl_exec",
            "exec"
        ],
        "danger_all": [
            "eval",
            "assert",
            "create_function",
            "system",
            "exec",
            "shell_exec",
            "passthru",
            "proc_open",
            "popen",
            "pcntl_exec",
            "base64_decode",
            "gzinflate",
            "gzuncompress",
            "gzdecode",
            "str_rot13",
            "hex2bin",
            "convert_uudecode"
        ],
        "inert_danger": [
            "eval",
            "assert",
            "system",
            "passthru",
            "shell_exec",
            "exec",
            "proc_open",
            "popen",
            "create_function",
            "base64_decode",
            "gzinflate",
            "gzuncompress",
            "str_rot13"
        ],
        "config_eval": [
            "eval",
            "base64_decode",
            "gzinflate",
            "gzuncompress",
            "str_rot13"
        ],
        "masked_danger": [
            "eval",
            "assert",
            "system",
            "exec",
            "shell_exec",
            "passthru",
            "proc_open",
            "popen",
            "pcntl_exec",
            "create_function",
            "base64_decode",
            "gzinflate",
            "gzuncompress",
            "str_rot13",
            "hex2bin"
        ]
    },
    "fold_transforms": [
        {
            "fn": "base64_decode",
            "arg": "b64"
        },
        {
            "fn": "str_rot13",
            "arg": "any"
        },
        {
            "fn": "strrev",
            "arg": "any"
        },
        {
            "fn": "strtolower",
            "arg": "any"
        },
        {
            "fn": "strtoupper",
            "arg": "any"
        },
        {
            "fn": "hex2bin",
            "arg": "hex"
        },
        {
            "fn": "gzinflate",
            "arg": "any"
        },
        {
            "fn": "gzuncompress",
            "arg": "any"
        },
        {
            "fn": "gzdecode",
            "arg": "any"
        }
    ],
    "backdoor_gate_needles": [
        "shell_exec",
        "passthru",
        "proc_open",
        "popen",
        "pcntl_exec",
        "system(",
        "exec("
    ],
    "db_prefilter_tokens": [
        "atob(",
        "new Function",
        "_0x",
        "charCodeAt",
        "fromCharCode",
        "base64_decode",
        "wp_ajx_request",
        "wp-tmp.php",
        "powershell",
        "mshta",
        "conhost --headless",
        "clipboard.writeText"
    ],
    "signatures": [
        {
            "id": "bot_heartbeat",
            "category": "hidden_admin",
            "label": "Backdoor cron hook (wp_extra_bot_heartbeat)",
            "severity": "critical",
            "pattern": "/wp_extra_bot_heartbeat/",
            "capture": false,
            "note": "Signature cron used by the user-hiding kit. No legitimate plugin uses this hook name."
        },
        {
            "id": "users_css_hide",
            "category": "hidden_admin",
            "label": "Admin Users list CSS row hiding (#user-ID display:none)",
            "severity": "critical",
            "pattern": "/#user-(\\d+)\\s*\\{[^}]*display\\s*:\\s*none/i",
            "capture": true,
            "note": "Hides a specific user row on the Users screen from logged-in admins. Almost never legitimate."
        },
        {
            "id": "query_where",
            "category": "hidden_admin",
            "label": "User-hiding SQL injection (query_where AND ID <> N)",
            "severity": "critical",
            "pattern": "/query_where\\s*\\.=[^;]{0,120}ID\\s*<>/s",
            "capture": false,
            "note": "Appends SQL that drops a specific user ID from user queries."
        },
        {
            "id": "rest_user_route",
            "category": "hidden_admin",
            "label": "REST users endpoint concealment (^/wp/v2/users/ID regex)",
            "severity": "high",
            "pattern": "~\\^/wp/v2/users/(\\d+)~",
            "capture": true,
            "note": "A regex-anchored REST user route used to return a fake 404 for a hidden account. Only matches the anchored regex form, not example URLs."
        },
        {
            "id": "id_compare",
            "category": "hidden_admin",
            "label": "Hardcoded user ID comparison ($obj->ID === N)",
            "severity": "high",
            "pattern": "/->ID\\s*===\\s*([1-9]\\d*)/",
            "capture": true,
            "note": "Strict identity comparison against a hardcoded user ID, used to 404 a hidden author archive."
        },
        {
            "id": "views_users",
            "category": "hidden_admin",
            "label": "User count tampering (views_users filter)",
            "severity": "medium",
            "pattern": "/add_filter\\(\\s*['\"]views_users['\"]/",
            "capture": false,
            "note": "Can decrement admin/all counts to hide an account, but Wordfence also registers this filter legitimately."
        },
        {
            "id": "rest_predispatch",
            "category": "hidden_admin",
            "label": "REST pre-dispatch interception (rest_pre_dispatch)",
            "severity": "medium",
            "pattern": "/rest_pre_dispatch/",
            "capture": false,
            "note": "Common in legitimate plugins (ACF, Gravity Forms). Only meaningful here when clustered with the kit."
        },
        {
            "id": "author_not_in",
            "category": "hidden_admin",
            "label": "Front-end author exclusion (author__not_in)",
            "severity": "medium",
            "pattern": "/author__not_in/",
            "capture": false,
            "note": "Removes a hidden author from main queries. Occasionally legitimate. Review in context."
        },
        {
            "id": "dropdown_users",
            "category": "hidden_admin",
            "label": "Author dropdown exclusion (wp_dropdown_users_args)",
            "severity": "medium",
            "pattern": "/wp_dropdown_users_args/",
            "capture": false,
            "note": "Hides a user from author dropdowns."
        },
        {
            "id": "rest_userquery",
            "category": "hidden_admin",
            "label": "REST user query exclusion (rest_user_query)",
            "severity": "medium",
            "pattern": "/rest_user_query/",
            "capture": false,
            "note": "Common in legitimate plugins (Gravity Forms). Only meaningful here when clustered with the kit."
        },
        {
            "id": "sitemap_users",
            "category": "hidden_admin",
            "label": "Sitemap user exclusion (wp_sitemaps_users_query_args)",
            "severity": "medium",
            "pattern": "/wp_sitemaps_users_query_args/",
            "capture": false,
            "note": "Keeps a hidden user out of the XML sitemap."
        },
        {
            "id": "xmlrpc_user",
            "category": "hidden_admin",
            "label": "XML-RPC user method removal (wp.getUsers / wp.getUser / wp.getProfile)",
            "severity": "medium",
            "pattern": "/wp\\.get(Users|User|Profile)\\b/",
            "capture": false,
            "note": "Also present legitimately in Wordfence request maps and WordPress core. Only meaningful here when clustered with the kit."
        },
        {
            "id": "req_eval",
            "category": "code_injection",
            "label": "Request-driven code execution (eval/assert on $_POST/$_GET/$_REQUEST/$_COOKIE)",
            "severity": "critical",
            "pattern": "/(?:eval|assert)\\s*\\(\\s*(?:stripslashes\\s*\\(\\s*)?\\$_(?:POST|REQUEST|GET|COOKIE)/i",
            "capture": false,
            "note": "An unauthenticated PHP shell. Anyone who sends the right request executes arbitrary code. This is the core of the eval backdoor."
        },
        {
            "id": "eval_decoder",
            "category": "code_injection",
            "label": "Obfuscated payload execution (eval of a decoder)",
            "severity": "critical",
            "pattern": "/eval\\s*\\(\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|rawurldecode|convert_uudecode|hex2bin)\\s*\\(/i",
            "capture": false,
            "note": "Executes a decoded/decompressed string. Standard way to hide a malicious payload from casual review."
        },
        {
            "id": "wpvcd_marker",
            "category": "code_injection",
            "label": "Theme-injection markers ($start_wp_theme_tmp / $end_wp_theme_tmp)",
            "severity": "critical",
            "pattern": "/\\$(?:start|end)_wp_theme_tmp/",
            "capture": false,
            "note": "The wrapper markers the theme-injection malware uses around the payload it writes into theme functions.php."
        },
        {
            "id": "wpvcd_tmp",
            "category": "code_injection",
            "label": "Persistence file reference (wp-tmp.php / wp-vcd.php)",
            "severity": "critical",
            "pattern": "/wp-(?:tmp|vcd)\\.php/i",
            "capture": false,
            "note": "This malware caches copies named wp-tmp.php / wp-vcd.php in wp-includes, the active theme, and the site root for persistence."
        },
        {
            "id": "wpvcd_shell_key",
            "category": "code_injection",
            "label": "Eval shell request key (wp_ajx_request)",
            "severity": "critical",
            "pattern": "/wp_ajx_request/",
            "capture": false,
            "note": "The POST key the eval shell reads code from."
        },
        {
            "id": "wpvcd_func",
            "category": "code_injection",
            "label": "Loader functions (theme_temp_setup / file_get_contents_tcurl)",
            "severity": "critical",
            "pattern": "/\\b(?:theme_temp_setup|file_get_contents_tcurl)\\b/",
            "capture": false,
            "note": "The theme-injection payload loader function names."
        },
        {
            "id": "wpvcd_c2",
            "category": "code_injection",
            "label": "Command-and-control domain (gatots.*)",
            "severity": "critical",
            "pattern": "/\\bgatots\\.(?:com|pw|top)\\b/i",
            "capture": false,
            "targets": [
                "php",
                "js"
            ],
            "note": "Documented C2 infrastructure the loader pulls live PHP from."
        },
        {
            "id": "remote_script_inject",
            "category": "code_injection",
            "label": "Known malicious remote script (lstyle-sdn.sbs)",
            "severity": "high",
            "pattern": "/lstyle-sdn\\.sbs/i",
            "capture": false,
            "targets": [
                "php",
                "js"
            ],
            "note": "A remote script injection domain seen on a previously cleaned client site. Often gated by is_admin() so admins do not see it."
        },
        {
            "id": "obf_js_executor",
            "category": "code_injection",
            "label": "Obfuscated JS executor (new Function(new TextDecoder(...)))",
            "severity": "critical",
            "pattern": "/new\\s+Function\\s*\\(\\s*new\\s+TextDecoder/i",
            "capture": false,
            "targets": [
                "php",
                "js"
            ],
            "note": "Runs a runtime-decoded string as live JavaScript. Core technique of injected crypto-drainer and ad-fraud scripts."
        },
        {
            "id": "obf_js_atob_blob",
            "category": "code_injection",
            "label": "Inline base64 blob passed to atob()",
            "severity": "critical",
            "pattern": "/atob\\s*\\(\\s*['\"][A-Za-z0-9+\\/]{60,}={0,2}['\"]\\s*\\)/",
            "capture": false,
            "note": "A long base64 string decoded at runtime. Standard wrapper for a hidden JavaScript payload."
        },
        {
            "id": "obf_js_xor",
            "category": "code_injection",
            "label": "XOR unpack loop (charCodeAt(...) ^ key)",
            "severity": "high",
            "pattern": "/charCodeAt[^\\^\\n]{0,30}\\^/i",
            "capture": false,
            "note": "Byte-by-byte XOR decryption, used to unpack an obfuscated payload before execution."
        },
        {
            "id": "php_close_script",
            "category": "code_injection",
            "label": "Script injected across PHP tags (<?php ?><script>)",
            "severity": "high",
            "pattern": "/<\\?php\\s*\\?>\\s*<script/i",
            "capture": false,
            "note": "An empty PHP tag immediately followed by a script tag. A classic artifact of markup injected into a PHP file such as functions.php."
        },
        {
            "id": "hex_obf_vars",
            "category": "code_injection",
            "label": "Hex-named obfuscated variables (_0x....)",
            "severity": "high",
            "pattern": "/_0x[0-9a-f]{4,}[\\s\\S]{0,300}_0x[0-9a-f]{4,}/",
            "capture": false,
            "note": "Multiple hex-named variables are the hallmark of a JavaScript obfuscator. Occasionally used by legitimate premium plugins, so review the match."
        },
        {
            "id": "plugin_self_hide",
            "category": "generic",
            "label": "Plugins list is filtered to remove entries (all_plugins)",
            "severity": "high",
            "pattern": "/add_filter\\s*\\(\\s*['\"]all_plugins['\"][\\s\\S]{0,400}(?:unset|array_diff_key|array_diff_assoc|array_filter|array_splice)\\s*\\(/i",
            "capture": false,
            "note": "Code registered on the all_plugins filter that removes entries from the Plugins screen listing. White-label and client-branding plugins do this deliberately to hide plugins from site editors, which is the benign form — so identify which plugin owns this code. If you do not run such a plugin, something is concealing itself or another plugin from you. The Self-concealment section of this report resolves the responsible file by running the filter live, which is the authoritative answer; this is a text match and is reported for review only."
        },
        {
            "id": "plugin_self_reference_hide",
            "category": "code_injection",
            "label": "Plugin removes its own basename from a filtered list",
            "severity": "critical",
            "pattern": "/plugin_basename\\s*\\(\\s*__FILE__\\s*\\)[\\s\\S]{0,800}\\ball_plugins\\b[\\s\\S]{0,400}(?:unset|array_diff_key|array_diff_assoc|array_splice)\\s*\\(|(?:unset|array_diff_key|array_diff_assoc|array_splice)\\s*\\([^;]{0,120}plugin_basename\\s*\\(\\s*__FILE__/i",
            "capture": false,
            "note": "The file computes its own plugin path and then removes that exact key from an array it is filtering. That is self-concealment: whichever list it is filtering (the Plugins screen, the update check, the action links), the effect is that this plugin disappears from it. No legitimate plugin removes itself from WordPress's own inventory."
        },
        {
            "id": "plugin_action_links_strip",
            "category": "generic",
            "label": "Deactivate/Delete links stripped from the plugin row",
            "severity": "medium",
            "pattern": "/add_filter\\s*\\(\\s*['\"]plugin_action_links(?:_[^'\"]*)?['\"][\\s\\S]{0,500}unset\\s*\\([^;]{0,200}['\"](?:deactivate|delete)['\"]/i",
            "capture": false,
            "note": "Code registered on a plugin action-links filter that removes the Deactivate and/or Delete row actions, so the plugin cannot be turned off or removed from the Plugins screen. Themes and frameworks that bundle required plugins (TGM Plugin Activation, as shipped with many commercial themes) do this legitimately, and so does a managed host; malware does it so an administrator who spots it still cannot remove it. Attribute it before acting — the Self-concealment section names the responsible file by running the filter live."
        },
        {
            "id": "plugin_update_suppress",
            "category": "generic",
            "label": "Plugin removes itself from the update check",
            "severity": "medium",
            "pattern": "/add_filter\\s*\\(\\s*['\"]site_transient_update_plugins['\"][\\s\\S]{0,500}unset\\s*\\([^;]{0,200}->\\s*response/i",
            "capture": false,
            "note": "Code registered on the update-check filter that removes a plugin from WordPress's update results, so it never appears on the Updates screen. This is normal for update-management tools and for premium plugins that self-manage updates through their own licence server (Gravity Forms add-ons do exactly this). It matters only alongside a plugin that also hides itself from the Plugins list, where it is part of the same concealment."
        },
        {
            "id": "js_indirect_eval",
            "category": "generic",
            "label": "Indirect JavaScript eval ((0,eval) / window[\"eval\"])",
            "severity": "high",
            "pattern": "/\\(\\s*0\\s*,\\s*eval\\s*\\)\\s*\\(|(?:window|globalThis|self|top|parent)\\s*\\[\\s*['\"]eval['\"]\\s*\\]|(?:window|globalThis|self)\\s*\\.\\s*eval\\s*\\(|\\beval\\s*\\?\\.\\s*\\(/i",
            "capture": false,
            "targets": [
                "php",
                "js"
            ],
            "note": "JavaScript written to call eval indirectly. The form is chosen for two reasons: it runs the code in global scope, and it does not look like \"eval(\" to a scanner searching for that literal. Only PHP files are scanned, so this is JavaScript embedded in PHP rather than a build artifact — a few bundlers emit this form into .js files, but hand-written inline PHP output has no reason to reach eval this way."
        },
        {
            "id": "js_fetch_eval",
            "category": "code_injection",
            "label": "Remote script fetched and executed (fetch -> eval / new Function)",
            "severity": "critical",
            "pattern": "/(?:fetch|XMLHttpRequest|\\$\\.get|\\$\\.ajax)\\s*\\([\\s\\S]{0,600}?(?:\\.\\s*text\\s*\\(\\s*\\)|responseText)[\\s\\S]{0,600}?(?:\\(\\s*0\\s*,\\s*eval\\s*\\)\\s*\\(|(?:window|globalThis|self)\\s*\\.\\s*eval\\s*\\(|(?<![\\w.])eval\\s*\\(|new\\s+Function\\s*\\()/i",
            "capture": false,
            "targets": [
                "php",
                "js"
            ],
            "note": "Downloads a remote response and executes it as JavaScript. This is a live loader: whatever the remote server returns runs in every visitor's browser on your domain, and it can be changed at any time without touching your site again. Payloads delivered this way include redirect and scam funnels, ad/SEO spam, crypto drainers, fake-captcha lures, and checkout card skimming. Nothing on disk records what was actually served. Remove it and treat data entered on the site during the exposure window as compromised."
        },
        {
            "id": "hook_name_obfuscated",
            "category": "generic",
            "label": "WordPress hook name built at runtime to hide it",
            "severity": "high",
            "pattern": "/add_(?:action|filter)\\s*\\(\\s*(?:base64_decode|str_rot13|strrev|hex2bin|gzinflate|gzuncompress|pack|implode|join)\\s*\\(|add_(?:action|filter)\\s*\\(\\s*strtolower\\s*\\(\\s*['\"][A-Z_]{4,}['\"]\\s*\\)/",
            "capture": false,
            "note": "The hook this code attaches to is assembled at runtime instead of written as a plain string, so the hook name never appears in the file. Ordinary dynamic hook names are built by interpolating a variable into a readable prefix; decoding or reassembling a constant has no purpose except to hide which hook is being used from anyone reading or scanning the file."
        },
        {
            "id": "injector_route_blocklist",
            "category": "generic",
            "label": "Injector route blocklist (wp-admin + xmlrpc + media extensions + administrator)",
            "severity": "high",
            "pattern": "/['\"]xmlrpc\\\\?\\.php['\"][\\s\\S]{0,800}['\"]\\\\\\.(?:mpg|mpeg|wmv|bmp|tiff)['\"][\\s\\S]{0,800}['\"]administrator['\"]/i",
            "capture": false,
            "note": "The distinctive route/extension blocklist carried by a family of WordPress and Joomla content injectors: skip admin, login, API, cron, feeds and static assets so the payload only fires on front-end HTML views by real visitors. The trailing \"administrator\" entry is the Joomla admin path, left in place by kits that target both platforms."
        },
        {
            "id": "error_log_suppression",
            "category": "generic",
            "label": "Error logging disabled at runtime (anti-forensics)",
            "severity": "medium",
            "pattern": "/ini_set\\s*\\(\\s*['\"](?:error_reporting|log_errors|display_errors)['\"][\\s\\S]{0,300}ini_set\\s*\\(\\s*['\"](?:error_reporting|log_errors|display_errors)['\"][\\s\\S]{0,300}ini_set\\s*\\(\\s*['\"](?:error_reporting|log_errors|display_errors)['\"]/i",
            "capture": false,
            "note": "Turns off error reporting, error logging and error display together, in one place. A plugin that silences its own failures this thoroughly leaves no trace in the logs when something goes wrong — which is useful to malware and to almost nothing else. On its own this is only a smell; next to a remote loader or a concealment filter it is part of the same design."
        },
        {
            "id": "clickfix_run_paste",
            "category": "code_injection",
            "label": "ClickFix run-and-paste instruction (Win+R then Ctrl+V)",
            "severity": "critical",
            "pattern": "/win(?:dows)?\\s*\\+\\s*r\\b[\\s\\S]{0,400}ctrl\\s*\\+\\s*v/i",
            "capture": false,
            "targets": [
                "php",
                "js"
            ],
            "note": "The fake-verification lure that tells a visitor to open the Run dialog and paste a command. Pathognomonic for ClickFix / ClearFake."
        },
        {
            "id": "clickfix_ps_encoded",
            "category": "code_injection",
            "label": "Encoded PowerShell command (-enc / -EncodedCommand)",
            "severity": "critical",
            "pattern": "/powershell[^\\n]{0,40}-e(?:nc|ncodedcommand)\\b/i",
            "capture": false,
            "targets": [
                "php",
                "js"
            ],
            "note": "A base64-encoded PowerShell command. Standard ClickFix and dropper technique to hide what runs."
        },
        {
            "id": "clickfix_ps_stealth",
            "category": "code_injection",
            "label": "Stealth PowerShell flags (hidden window / bypass / noprofile)",
            "severity": "critical",
            "pattern": "/powershell(?:\\.exe)?\\b[\\s\\S]{0,120}(?:-w\\s+hidden|-windowstyle\\s+hidden|-ep\\s+bypass|-executionpolicy\\s+bypass|-nop\\b|-noprofile\\b)/i",
            "capture": false,
            "targets": [
                "php",
                "js"
            ],
            "note": "A hidden, policy-bypassing PowerShell invocation. Not something legitimate WordPress code ever emits."
        },
        {
            "id": "clickfix_mshta",
            "category": "code_injection",
            "label": "Remote mshta loader (mshta http / javascript:)",
            "severity": "critical",
            "pattern": "/mshta(?:\\.exe)?\\s+(?:https?:|javascript:)/i",
            "capture": false,
            "targets": [
                "php",
                "js"
            ],
            "note": "Runs remote HTML/script through mshta. Common ClickFix and malvertising second stage."
        },
        {
            "id": "clickfix_conhost",
            "category": "code_injection",
            "label": "Headless console launcher (conhost --headless)",
            "severity": "critical",
            "pattern": "/conhost(?:\\.exe)?\\s+--headless/i",
            "capture": false,
            "targets": [
                "php",
                "js"
            ],
            "note": "Launches a hidden console, frequently used by ClickFix to run its payload without a visible window."
        },
        {
            "id": "clickfix_clipboard_cmd",
            "category": "code_injection",
            "label": "Clipboard write paired with a shell command",
            "severity": "high",
            "pattern": "/(?:navigator\\.clipboard\\.writeText|execCommand\\(\\s*['\"]copy['\"])[\\s\\S]{0,300}(?:powershell|mshta|cmd\\s*\\/c|cmd\\.exe|\\biex\\b|Invoke-Expression|\\.hta\\b)/i",
            "capture": false,
            "targets": [
                "php",
                "js"
            ],
            "note": "Silently copies a shell command to the clipboard so the visitor pastes it themselves. The mechanical core of ClickFix."
        },
        {
            "id": "clickfix_iex_download",
            "category": "code_injection",
            "label": "Download-and-execute one-liner (iwr/DownloadString piped to iex)",
            "severity": "high",
            "pattern": "/(?:iwr|Invoke-WebRequest|DownloadString|Net\\.WebClient)[\\s\\S]{0,100}(?:\\|\\s*iex\\b|Invoke-Expression)/i",
            "capture": false,
            "targets": [
                "php",
                "js"
            ],
            "note": "Fetches a remote script and runs it in memory. Common final stage of ClickFix and other droppers."
        }
    ],
    "definite_ioc_ids": [
        "bot_heartbeat",
        "users_css_hide",
        "query_where"
    ],
    "kit_signature_ids": [
        "bot_heartbeat",
        "users_css_hide",
        "query_where",
        "rest_user_route",
        "id_compare",
        "author_not_in",
        "dropdown_users",
        "rest_userquery",
        "sitemap_users",
        "xmlrpc_user",
        "rest_predispatch",
        "views_users"
    ],
    "harvest_signature_ids": [
        "users_css_hide",
        "rest_user_route",
        "id_compare"
    ]
}