Forensic investigation
Investigating a web shell: forensic triage and timeline
A step-by-step forensic workflow for a suspected web shell: preservation, artifact collection on IIS and Linux, timestamp analysis, timeline building and scoping the intrusion.