Write, test and tune YARA rules for suspicious server-side scripts and Sigma rules for web shell behaviour in logs and process telemetry — with annotated examples and a false-positive strategy.
Detect web shell activity from process telemetry: suspicious children of IIS, Apache, nginx/PHP-FPM and Java servers, with Sysmon, Event 4688, auditd, KQL and Sigma examples.
Find web shells in IIS, Apache and nginx access logs: rare URIs, POST-heavy files, few-client patterns, odd user agents and response sizes — with awk, PowerShell, KQL and SPL examples.
How to baseline web roots, detect new or modified executable files, hunt with find, PowerShell and osquery, and tune file integrity monitoring so web shells stand out.