Which detection method identifies signs of a hidden web shell by analyzing server logs and traffic for encoding and unusual user agents?

• A. Data Staging
• B. Use of Web Shell Detection
• C. HTTP User Agent Detection
• D. Indicators of Compromise (IoCs)

Answer: (B)

Detecting hidden web shells through log and traffic analysis focuses on spotting how attackers hide their backdoors in web traffic. A web shell often communicates with its controller by sending encoded payloads or obfuscated requests and using unusual or nonstandard user-agent strings to blend in or avoid detection. By routinely inspecting server access and error logs for signs like base64-encoded or double-encoded data in URLs or POST bodies, high-entropy strings, unusual query patterns, and user-agent fields that don’t match typical browser or admin tools, you can identify suspicious activity that points to a hidden shell. Correlating these findings with changes in the web root—such as new or recently modified files—strengthens the case for a shell being present. This approach is well-suited to catching web shells because it targets the specific ways these backdoors conceal commands and traffic, rather than relying on generic indicators or solely on user-agent checks.