Support

There is no need for extension-specific actions. The idea is that Admin Tools works by proactively preventing or mitigating entire classes of vulnerabilities, not reactively protecting against known vulnerabilities long after the initial and most lethal wave of attacks is over.

The majority of these issues were unauthenticated uploads. There is really no way to tell if an upload falls under that or not. The extension developer should've been doing the two basic things Joomla asks of us 3DPs: authorization, and go through the Joomla\Input\Files for uploads. Since this is not the case, nothing can prevent the upload from happening without kneecapping the otherwise legitimate feature of the third party extensions. See https://www.akeeba.com/news/1785-protecting-old-sites-against-joomla-extensions-zero-days.html for some examples which provide far better context than I can give you in this reply.

That said, even if the unauthenticated uploads go through, Admin Tools does block them because of its .htaccess Maker's Frontend Protection feature. That's the entire reason I came up with this concept nearly twenty years ago – and why Admin Tools even exists: I made a component to provide a user interface for generating a customized version of what was then my "Master .htaccess file" and that grew into Admin Tools. The idea here is that the file is uploaded, but it's inert.

The PHP File Change Scanner can also catch newly added files on your site. This lets you identify these malicious (but inert) files and remove them.

It doesn't block the attack action, the uploading of the file. It makes it inert, and it makes it discoverable. It buys you time to install the update and clean up without suffering a site breach from a zero-day attacks. That's the whole point.

What I've said in the past is that Admin Tools is like a Kevlar vest for your site. A kevlar vest won't stop the assailant from shooting at you, or even hit you, but it will prevent their projectile from killing you. You still catch the projectile, it is annoying, but you're neither grievously injured nor dead which means you now have time to move so you can protect yourself against further assaults. The assailant may get a lucky shot that kills you despite body armor, but the chances are pretty slim; that is to say no protection is perfect, but it makes it much less likely you'll get killed compared to having no protection.