Hunting For Webshell Activity
FreeProactively detect web shell threats on servers.
Free · Opens the source repo
What Hunting For Webshell Activity does
The Hunting For Webshell Activity skill is designed for cybersecurity professionals seeking to identify and mitigate web shell threats on internet-facing servers. This skill operates on a hypothesis-driven approach, allowing users to analyze file creation in web directories, suspicious child-process spawning from web server processes, and anomalous HTTP request patterns. It is particularly useful in scenarios following a public-facing application compromise or when alerts are triggered by EDR/SIEM systems regarding web server process anomalies.
Users can leverage this skill during incident response to effectively scope potential compromises related to web shell techniques. The workflow begins with formulating a hypothesis based on threat intelligence or ATT&CK gap analysis, followed by identifying necessary data sources. Users execute queries against their EDR and SIEM platforms to collect relevant events, analyze the results for anomalies, and validate findings through contextual analysis. This systematic approach helps in correlating activities with broader attack chains and threat actor tactics, techniques, and procedures (TTPs).
The skill requires a robust security infrastructure, including an EDR platform with telemetry capabilities, a SIEM for log analysis, and threat intelligence feeds for IOC correlation. It is aimed at security analysts, incident responders, and threat hunters looking to enhance their detection capabilities against web shell threats. By documenting and reporting findings, users can update detection rules and recommend appropriate response actions, ensuring a proactive stance against potential threats.
When to use it
Use this skill when proactively hunting for web shell indicators or during incident response to investigate potential compromises.
When not to use it
This skill may not be suitable for environments without the required EDR or SIEM systems in place, or for users unfamiliar with threat hunting methodologies.
What you can build with it
Proactive Threat Hunting
Utilize the skill to actively search for indicators of web shell activity in your environment.
Incident Response
Deploy the skill during incident response to assess and scope compromises related to web shell techniques.
Security Assessments
Incorporate the skill into periodic security assessments to evaluate the resilience of your web servers against web shell threats.
How to install Hunting For Webshell Activity
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-webshell-activity --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting For Webshell Activity
When to Use
- When proactively hunting for indicators of hunting for webshell activity in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises
Prerequisites
- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
- Sysmon deployed with comprehensive configuration
- Windows Security Event Log forwarding enabled
- Threat intelligence feeds for IOC correlation
Workflow
- Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
- Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
- Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
- Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
- Validate Findings: Distinguish true positives from false positives through contextual analysis.
- Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
- Document and Report: Record findings, update detection rules, and recommend response actions.
Key Concepts
| Concept | Description |
|---|---|
| T1505.003 | Web Shell |
| T1190 | Exploit Public-Facing Application |
| T1059.001 | PowerShell |
Tools & Systems
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Common Scenarios
- Scenario 1: China Chopper web shell via IIS vulnerability
- Scenario 2: ASPXSpy through vulnerable upload
- Scenario 3: PHP shell hidden in image file
- Scenario 4: JSP shell via Tomcat manager console
Output Format
Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1505.003
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Frequently asked questions about Hunting For Webshell Activity
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.