A web shell is server-side code (.aspx, .php, .jsp) an attacker plants in your web root to get remote command execution through the web server - a favorite foothold after exploiting an internet-facing app (think ProxyShell, MOVEit).
How they land
- Exploiting an RCE or file-upload flaw in the app.
- Abusing a misconfiguration that allows writing to the web root.
Once planted, the attacker just browses to /uploads/shell.aspx?cmd=whoami.
High-fidelity detections
- File integrity monitoring on web roots - a new or modified script file where none should appear is a strong signal.
- The web-server process spawning shells -
w3wp.exe/httpd/php-fpmlaunchingcmd.exe,powershell,/bin/sh. Legitimate web apps rarely do this. - Anomalous requests - odd query params (
cmd=,exec=), rare user agents, requests to never-before-seen paths.
Signatures alone miss obfuscated or novel shells - behavior (new file + web server spawning a shell) is what catches them reliably.
Response
Preserve the shell for analysis, pull the web/access logs to scope what commands ran and when it was planted, then remove it, fix the entry vector, and hunt for persistence and lateral movement.