Check occurrence of web shell behaviors (Webshell List)

Available in VPC

You can view and manage web shell behaviors that the agent detected from the client's server in the WebShell List menu.
In this menu, you can view the information such as server information, time of detection, process information, and suspicious attacker IP, which can be referenced to determine and respond to web shell behaviors. You can also view the list of suspicious web shell files that caused the detected web shell behaviors, isolate or restore them, and easily add exceptions based on the detected web shell behaviors.

View details of web shell behaviors

If you've received a notification about web shell behavior detection, you can see the details and take necessary measures on the NAVER Cloud Platform console's web shell behaviors list (Webshell List).

To view details of web shell behaviors:

1. From the NAVER Cloud Platform console's VPC environment, navigate to > Services > Security > Webshell Behavior Detector.
2. Navigate to Detection List > WebShell List.
3. Click the web shell behavior item you'd like to check.
   • Details of the the web shell behavior are displayed.

The interface of the list of web shell behaviors includes the following components:

View suspicious files

You can view the list of suspicious web shell files related to detected web shell behaviors, and isolate files identified as web shells or restore isolated files.

To view files suspicious to be web shells:

1. From the NAVER Cloud Platform console's VPC environment, navigate to > Services > Security > Webshell Behavior Detector.

2. Navigate to Detection List > WebShell List.

3. In the Suspicious files area of the item to check, click [View].

   • You can also click the item and then the [Isolate/Restore file] button at the top of the list.

4. Click the file from the list popup to see the details.
   

5. If the detected behavior is determined to be a web shell, click the [Isolate file] next to Isolate/Restore to isolate the file.

   • The file is isolated in the same path with a name that will be difficult for attackers to guess.
     (Example: /var/www/html/uploads/webshell.php.webshell_20200320012000.BC98D127F4)
   • The web shell behavior item is processed as checked (with gray icon and text), and the isolated file is added to the list of suspicious files (Quarantine).
   • When a file is isolated, the [Isolate file] button is changed to [Restore file] which allows you to restore the file if required. When you restore an isolated file, you can't isolate or restore other files anymore from that page.

View suspicious IPs

You can view a list of suspicious attacker IPs related to detected web shell behaviors.

To view the list of suspicious IPs:

1. From the NAVER Cloud Platform console's VPC environment, navigate to > Services > Security > Webshell Behavior Detector.
2. Navigate to Detection List > WebShell List.
3. In the Suspicious IPs area of the item to check, click [View].
4. Check the suspicious IP information from the list popup.
   

Treat as exception

When a detected web shell behavior item turns out to be a normal action, you can treat them as an exception so that the behavior is not detected again.

To treat a web shell behavior as an exception:

1. From the NAVER Cloud Platform console's VPC environment, navigate to > Services > Security > Webshell Behavior Detector.

2. Navigate to Detection List > WebShell List.

3. Click the item to treat as an exception, and click [Treat as exception].

4. Enter a name for the rule in the settings popup, and edit the entered value if necessary.
   

   • Only web shell behaviors that meet all the conditions of the exception rules (AND condition) are excepted.
   • Conditions that can be selected when creating exception rules are as follows:
     • START: Starting with the entered string.
     • END: Ending with the entered string.
     • NOT USE: Not using this condition.

5. When you finish setting up, click [Yes].
   • The web shell behaviors treated as exceptions are moved to the exception rule list (Excepted List).

Treat as checked/unchecked

The newly detected web shell behaviors are marked in red for identification. If you isolate the suspicious files from the item, the red mark automatically disappears. But if the item doesn't need to be isolated, you can change the check status manually.

To change a web shell behavior's check status:

1. From the NAVER Cloud Platform console's VPC environment, navigate to > Services > Security > Webshell Behavior Detector.
2. Navigate to Detection List > WebShell List.
3. In the Check area of the item to treat as checked, click .
   • The color of the icon and text is changed to gray.
   • To revert back to the unchecked status, click the icon once again.

Add memo

You can add memos to web shell behaviors, such as a brief description or additional information.

To add a memo:

1. From the NAVER Cloud Platform console's VPC environment, navigate to > Services > Security > Webshell Behavior Detector.
2. Navigate to Detection List > WebShell List.
3. Click the item to add a memo to, then click the [Edit] button next to Memo in the details area.
4. Enter the memo and click [Save].

Delete detection history

You can delete unnecessary web shell behavior items.

To delete a web shell behavior item:

1. From the NAVER Cloud Platform console's VPC environment, navigate to > Services > Security > Webshell Behavior Detector.
2. Navigate to Detection List > WebShell List.
3. Click a web shell behavior item, then click [Delete detection history].
4. In the confirmation popup, click [Yes].