Detecting Web Shells

Knowing how to detect web shells is an essential skill for SOC Analysts and Incident Responders. Web shells are a common technique attackers use to gain an initial foothold on target systems. They provide remote access, enabling various actions later in the attack chain. In this room, we will begin by refreshing our understanding of web shells, then dive into detection techniques using a variety of logs and tools.

Learning Objectives

• Understand what web shells are and how attackers use them
• Detect web shell activity through log, file system, and network analysis
• Understand common tooling in web shell detection

Room Prerequisites

A basic understanding of the topics below will be helpful during this walkthrough.

• Web Application Basics: HTTP Request Methods & Responses
• Intro to Log Analysis: Common Log Formats
• MITRE: Initial Access & Persistence Tactics