Notable incidents
Notable web shell incidents, from ProxyLogon to ToolShell
Factual summaries of public web shell campaigns — Equifax, Exchange ProxyLogon and ProxyShell, NetScaler, MOVEit, Ivanti, SharePoint ToolShell — and their lessons.
Defender's reference · MITRE T1505.003
Find the web shell before it finds your data.
A practical reference for blue teams and incident responders: how web shells get planted, where they leave traces, how to investigate them, and how to eradicate and harden for good.
- Areas
- 6
- In-depth guides
- 9
- Glossary terms
- 12
case-0142 · correlated timelinehigh
- 10:42:07FIMw3wp.exe created /aspnet_client/.../errorpage.aspx
- 10:42:49LOGPOST /aspnet_client/.../errorpage.aspx · 1 client · no referer
- 10:42:50PROCw3wp.exe → cmd.exe /c whoami /all
- 10:45:13PROCw3wp.exe → cmd.exe → nltest /dclist:
Defence map
From first write to lessons learned
Six areas that follow a web shell intrusion end to end. Each one links to its hub of guides.
01
Fundamentals
What web shells are, why attackers rely on them, and how to classify them by form factor and behaviour.
T1505.003persistencetaxonomy1 guide
02
How they get planted
The vulnerability classes behind deployment — uploads, RCE, file-write bugs, stolen admin access, edge appliances.
file uploadRCEpath traversal1 guide
03
Indicators & detection
File integrity, web server logs, process trees and YARA/Sigma rules — the four layers where shells show up.
FIMw3wp.exeYARASigma4 guides
04
Forensic investigation
Preserve evidence, find the true creation time, rebuild the timeline and scope every foothold.
timeline$MFTtimestomping1 guide
05
Eradication & hardening
Remove every foothold, rotate what was exposed, then close the doors: uploads, least privilege, WAF, allow-listing.
no-exec uploadsWAFWDACSELinux1 guide
06
Notable incidents
Public cases from Equifax to ProxyShell, MOVEit and ToolShell — summarised factually, with lessons for defenders.
ProxyLogonProxyShellMOVEit1 guide
Where shells leave traces
Four layers, one intrusion
A web shell can hide from one control, rarely from all four. Layered visibility is the whole game.
- L1
Files
New executable files in web-served paths, changed configs, odd owners and timestomped timestamps.
FIM · Sysmon 11 · auditd
- L2
Web logs
Rare URIs, POST-only pages, a handful of clients, empty referers and wildly varying response sizes.
W3C · combined · KQL
- L3
Process trees
w3wp.exe, httpd, php-fpm or java spawning shells and reconnaissance tools like whoami and nltest.
Sysmon 1 · 4688 · EDR
- L4
Memory
In-memory implants, injected assemblies, filters and modules that never touch the disk.
memory image · modules
Guides
Latest guides
Eradication & hardening
Eradicating web shells and hardening web servers
Remove web shells without leaving the intruder a way back, then harden: safe upload handling, no-exec directories for nginx, Apache and IIS, WAF, least privilege and application allow-listing.
Forensic investigation
Investigating a web shell: forensic triage and timeline
A step-by-step forensic workflow for a suspected web shell: preservation, artifact collection on IIS and Linux, timestamp analysis, timeline building and scoping the intrusion.
Indicators & detection
YARA and Sigma rules for web shell detection
Write, test and tune YARA rules for suspicious server-side scripts and Sigma rules for web shell behaviour in logs and process telemetry — with annotated examples and a false-positive strategy.
Indicators & detection
Process-tree detection: w3wp, httpd or java spawning shells
Detect web shell activity from process telemetry: suspicious children of IIS, Apache, nginx/PHP-FPM and Java servers, with Sysmon, Event 4688, auditd, KQL and Sigma examples.
Indicators & detection
Web server log analysis for web shell detection
Find web shells in IIS, Apache and nginx access logs: rare URIs, POST-heavy files, few-client patterns, odd user agents and response sizes — with awk, PowerShell, KQL and SPL examples.
Defensive by design
Everything here is written for defenders: concepts, detections, forensics and hardening. We never publish web shell source code, deployable payloads or exploit code.