What attackers do. Attackers plant a web shell, a small script on a web server that accepts commands over HTTP, giving them persistent remote control of the server. It typically follows exploitation of a public-facing application and serves the Persistence tactic.
How to defend. Patch internet-facing applications, restrict write access to web directories and run web services with minimal privileges. Use file integrity monitoring on web roots and deploy endpoint detection on web servers. Web application firewalls can block known web shell traffic.
Signs to look for. Look for new or modified script files in web directories, web server processes spawning command shells, unusual requests to rarely used pages and POST requests to static content locations. A common gap is web servers without endpoint agents or file integrity monitoring.