# Webshell Detection Methods

## File-Based Detection

### Signature Scanning
- YARA rules for known webshell patterns
- AV/EDR signature databases
- Custom grep patterns for suspicious function calls

### Statistical Analysis
- **Entropy**: Obfuscated webshells have high entropy (>5.5)
- **Index of Coincidence**: Distinguishes encrypted from natural text
- **Longest word length**: Long strings suggest encoding
- **Compression ratio**: Encrypted data doesn't compress well

### File System Anomalies
- Files with recent modification in old deployment directories
- Files not matching deployment inventory
- Unusual file permissions (writable by web server)
- Files in upload directories with executable extensions

## Log-Based Detection

### Web Server Access Logs
```bash
# POST requests to unusual files
grep "POST.*\.php" access.log | grep -v "known_endpoints"

# Requests with command parameters
grep "cmd=\|exec=\|shell=" access.log

# Single-IP accessing single unusual file repeatedly
awk '{print $1, $7}' access.log | sort | uniq -c | sort -rn
```

### Indicators in Logs
- POST to files that normally receive only GET
- Unusual User-Agent strings
- Large response bodies from small scripts
- Regular pattern of requests (automated C2)

## Behavioral Detection

- Web server process spawning child processes (cmd.exe, /bin/sh)
- Outbound network connections from web server process
- File system modifications outside expected directories
- Database queries from unexpected scripts

## Real-Time Monitoring

- Web Application Firewall (WAF) rules
- File integrity monitoring (AIDE, OSSEC, Tripwire)
- Process monitoring (Sysmon, auditd)
- Network traffic analysis for webshell communication patterns