Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Web shell on a public-facing server

A web shell is a foothold that looks like ordinary web traffic. The detection is usually a file or a process ancestry that makes no sense, and the investigation is mostly about how long it has been there.

Trigger. An unfamiliar file in a web root, a web server process spawning a shell, or outbound traffic from a machine that should only ever receive it.

The first 70 minutes2 of 5 expire
035 min70
  1. 01

    Capture connections and process ancestry

    by 10 minexpires

    A web server process with a shell or interpreter as its child is the whole finding. Record the established connections at the same moment, because they name the other end.

  2. 02

    Preserve the web root and the access logs

    by 25 minexpires

    Copy the file with its timestamps intact, do not open it in place on a live server, and pull the access logs before rotation. The request that first hit the shell dates the foothold.