Skip to content
WebShells

Area

Indicators & detection

4 guides in this area. Read them in order or jump to any one.

  1. Detecting web shells with file integrity monitoring

    How to baseline web roots, detect new or modified executable files, hunt with find, PowerShell and osquery, and tune file integrity monitoring so web shells stand out.

  2. Web server log analysis for web shell detection

    Find web shells in IIS, Apache and nginx access logs: rare URIs, POST-heavy files, few-client patterns, odd user agents and response sizes — with awk, PowerShell, KQL and SPL examples.

  3. Process-tree detection: w3wp, httpd or java spawning shells

    Detect web shell activity from process telemetry: suspicious children of IIS, Apache, nginx/PHP-FPM and Java servers, with Sysmon, Event 4688, auditd, KQL and Sigma examples.

  4. YARA and Sigma rules for web shell detection

    Write, test and tune YARA rules for suspicious server-side scripts and Sigma rules for web shell behaviour in logs and process telemetry — with annotated examples and a false-positive strategy.

All guides in this area

Indicators & detection

YARA and Sigma rules for web shell detection

Write, test and tune YARA rules for suspicious server-side scripts and Sigma rules for web shell behaviour in logs and process telemetry — with annotated examples and a false-positive strategy.

detectionyara