skills.rest
balsm-health
balsm-healthOFFICIAL
Explore all skills by this author →
Website𝕏@balsm_healthGitHub

hunting-for-webshell-activity

Detect webshell deployments by analyzing process creation, network, and web access logs.

2|Updated Jun 5, 2026
Search Tags:#threat hunting#SIEM#EDR#security incident response#webshell detection
One-click install
npx skills add https://github.com/balsm-health/Balsm-AI --skill hunting-for-webshell-activity
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-webshell-activity
Source: https://github.com/balsm-health/Balsm-AI/tree/main/plugin/skills/hunting-for-webshell-activity
Command: npx skills add https://github.com/balsm-health/Balsm-AI --skill hunting-for-webshell-activity

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies potential webshell deployments by analyzing file creation in web directories, suspicious process spawning from web servers, and anomalous HTTP patterns.

Core Features & Use Cases

  • Multi-Layer Analysis: Examines process trees, log data, and network traffic to detect webshell deployments.
  • Integration with Security Tools: Works with EDR platforms and SIEM systems like CrowdStrike, Microsoft Defender for Endpoint, Splunk, Elastic, and Sysmon.
  • Customizable Detection Queries: Enables users to run detection queries based on specific indicators and thresholds.

Quick Start

Use the hunting-for-webshell-activity skill to perform a webshell hunt on the server named 'webserver1'.

Frequently Asked Questions about hunting-for-webshell-activity

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect webshell activity across my network and server logs?▼

Webshell activity is detected by analyzing process creation logs, network logs, and web access logs for suspicious process spawning from web servers, file creation in web directories, and anomalous HTTP patterns.

What logs do I need to collect for webshell detection and threat hunting?▼

Webshell detection requires sysmon logs, Windows Security Event Logs, web server logs, and threat intelligence feeds to accurately analyze process creation events and anomalous HTTP patterns.

Does this webshell detection approach work with Splunk, Elastic, and CrowdStrike?▼

Yes, webshell threat hunting integrates with EDR platforms and SIEM systems including CrowdStrike, Microsoft Defender for Endpoint, Splunk, Elastic, and Sysmon for analyzing process trees and log data.

How do I investigate suspicious process spawning from my web server?▼

Investigate suspicious process spawning by examining process creation logs and process trees to identify anomalous child processes originating from web server applications, indicating potential webshell deployments.

Can I run customized detection queries to hunt for specific webshell indicators?▼

Yes, you can run customizable detection queries based on specific indicators and thresholds to hunt for webshell activity across file creation events, network traffic, and web access logs.

What's the best way to perform a webshell hunt on a specific server?▼

Perform a webshell hunt on a specific server by executing a threat hunting query against its web server logs, sysmon data, and Windows Security Event Logs to identify anomalous HTTP patterns and suspicious processes.

Related Skills

xenitV1xenitV1
132

red-team-tactics

Model attacker techniques mapped to MITRE ATT&CK phases for defender simulations.

Community
Intermediate
briiirussellbriiirussell
345

incident-triage

Classify security incidents and produce initial triage plans with NIST SP 800-61r2 methodology.

Community
Intermediate
woohyun212woohyun212
21

siem-rule

Convert threat objectives into Sigma rules and cross-platform SIEM detection queries.

Community
Advanced
Q16GQ16G
83

log-analysis

Analyze multi-source security logs to identify threat indicators and enable threat hunting.

Community
Intermediate