A webshell is a small script an attacker drops into your web root that gives them command execution through a normal HTTP request. It is quiet, it survives reboots, and it usually outlives the vulnerability that let it in.
Why webshells are hard to spot
Most webshells are a few lines long and sit in a directory full of legitimate files with similar names. They do not open a new port, they do not run as a separate process, and they do not appear in your auth logs, the traffic looks like ordinary web requests.
Manual detection
Start with recently modified files in your web root:
find /var/www -type f -name "*.php" -mtime -7 -ls
Then look for the function calls webshells rely on:
grep -rniE "eval\(|base64_decode\(|shell_exec\(|passthru\(|system\(" /var/www --include=*.php
Legitimate code does use some of these, so expect false positives. The useful signal is the combination: a recently changed file, in an upload directory, containing an obfuscated call.
What actually works long-term
Manual scans catch what is already there. They do not catch the next one. Three things do:
- File integrity monitoring : hash every file in the web root, alert on change
- Baselining : know what normal looks like per server, so a new file in
/uploadsstands out - Automated triage : most alerts are noise; something has to separate signal from it
That is the loop SecAI runs continuously: hash, compare, flag, and let an AI pipeline validate before a human is paged.