hunting-for-webshell-activity
OfficialDetect and investigate webshell activity across multiple layers
Authorbalsm-health
Version1.0.0
Installs0
System Documentation
What problem does it solve?
This Skill identifies potential webshell deployments by analyzing file creation in web directories, suspicious process spawning from web servers, and anomalous HTTP patterns.
Core Features & Use Cases
- Multi-Layer Analysis: Examines process trees, log data, and network traffic to detect webshell deployments.
- Integration with Security Tools: Works with EDR platforms and SIEM systems like CrowdStrike, Microsoft Defender for Endpoint, Splunk, Elastic, and Sysmon.
- Customizable Detection Queries: Enables users to run detection queries based on specific indicators and thresholds.
Quick Start
Use the hunting-for-webshell-activity skill to perform a webshell hunt on the server named 'webserver1'.
Dependency Matrix
Required Modules
python
Components
scriptsreferences
💻 Claude Code Installation
Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.
Please help me install this Skill: Name: hunting-for-webshell-activity Download link: https://github.com/balsm-health/Balsm-AI/archive/main.zip#hunting-for-webshell-activity Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
Agent Skills Search Helper
Install a tiny helper to your Agent, search and equip skill from 620,000+ vetted skills library on demand.