Notable incidents
Notable web shell incidents, from ProxyLogon to ToolShell
Factual summaries of public web shell campaigns — Equifax, Exchange ProxyLogon and ProxyShell, NetScaler, MOVEit, Ivanti, SharePoint ToolShell — and their lessons.
Guides
In-depth, defender-first guides on detecting, investigating and eradicating web shells.
Eradication & hardening
Eradicating web shells and hardening web servers
Remove web shells without leaving the intruder a way back, then harden: safe upload handling, no-exec directories for nginx, Apache and IIS, WAF, least privilege and application allow-listing.
Forensic investigation
Investigating a web shell: forensic triage and timeline
A step-by-step forensic workflow for a suspected web shell: preservation, artifact collection on IIS and Linux, timestamp analysis, timeline building and scoping the intrusion.
Indicators & detection
YARA and Sigma rules for web shell detection
Write, test and tune YARA rules for suspicious server-side scripts and Sigma rules for web shell behaviour in logs and process telemetry — with annotated examples and a false-positive strategy.
Indicators & detection
Process-tree detection: w3wp, httpd or java spawning shells
Detect web shell activity from process telemetry: suspicious children of IIS, Apache, nginx/PHP-FPM and Java servers, with Sysmon, Event 4688, auditd, KQL and Sigma examples.
Indicators & detection
Web server log analysis for web shell detection
Find web shells in IIS, Apache and nginx access logs: rare URIs, POST-heavy files, few-client patterns, odd user agents and response sizes — with awk, PowerShell, KQL and SPL examples.
Indicators & detection
Detecting web shells with file integrity monitoring
How to baseline web roots, detect new or modified executable files, hunt with find, PowerShell and osquery, and tune file integrity monitoring so web shells stand out.
How web shells get planted
How web shells get planted: vulnerability classes
A conceptual map of the vulnerability classes that let attackers drop web shells — file uploads, RCE, file-write primitives, stolen admin access and more — with the defensive control for each.
Web shell fundamentals
What is a web shell? A defender's primer
What web shells are, why attackers rely on them, how they are classified, and where they sit in the attack lifecycle — explained for defenders, without payloads.