Detecting Web Shell Deployment Attacks Against Apache HTTP Servers Through Web-Server File Integrity Monitoring and Automated Process Isolation

Modern web applications hosted on Apache HTTP Servers depend on web-server files, application scripts, configuration files, and supporting resources to provide application functionality. If an attacker successfully places a malicious web shell inside a web-accessible directory, the attacker may attempt to execute commands through HTTP requests and maintain unauthorized control over the compromised server.

A web shell is a malicious server-side script or executable component placed on a web server to provide remote command execution or persistent access through web requests. Detecting such deployment requires monitoring changes to web-server directories and correlating suspicious file modifications with process activity.

In this use case, an Apache HTTP Server is deployed as the controlled web-server environment on an Ubuntu virtual machine. The Apache document root and relevant web-server directories are monitored for unexpected file creation and modification.

A controlled web-shell deployment assessment is performed from Kali Linux. A controlled test web-shell file is introduced into the laboratory Apache web directory to validate whether the monitoring mechanism identifies the file modification. Wazuh is used for file integrity monitoring and security-event collection, while OpenSearch is used for security-event analysis.

The security assessment focuses on determining whether a newly deployed or modified web-server file can be detected and correlated with suspicious process activity.

The proposed defensive mechanism implements web-server file integrity monitoring and automated process isolation. File changes within monitored Apache directories generate security events, while suspicious activity can trigger an automated response that isolates the associated process from continued execution.

After implementing the security controls, the web-shell deployment assessment is repeated to verify that the malicious file change is detected and that the corresponding suspicious process activity is contained.

Complete Security Flow: Apache Web Directory → Web Shell File Deployment → File Integrity Change Detected → Security Event Generated → Suspicious Process Activity Correlated → Alert Generated → Automated Process Isolation → Incident Validation

Apache HTTP Server is used as the controlled web-server environment for testing web-shell deployment and server-side file-integrity security. The Apache document root contains web-accessible files that are processed or served by the web server. If an attacker places a malicious server-side file into a web-accessible directory, the file may potentially be invoked through an HTTP request.

Web-shell deployment becomes difficult to detect when changes to Apache web-server directories are not continuously monitored. A newly created or modified server-side file may appear similar to a legitimate application file unless file-integrity monitoring and process-level security monitoring are implemented. The proposed solution introduces file integrity monitoring for Apache web-server directories and correlates file-change events with suspicious process activity so that web-shell deployment can be detected and the associated process can be isolated.

The security problem is therefore:

Implement file integrity monitoring for Apache web-server directories and correlate file-change events with suspicious process activity to detect web-shell deployment and isolate the associated process.

A web shell deployment attack involves placing a malicious server-side script or executable component within a web-accessible server directory. The attacker first identifies a location where a server-side file can be introduced into the Apache web directory. During controlled testing, a benign laboratory web-shell simulation is placed within the monitored Apache document root. The deployed file is then accessed through the controlled HTTP service to generate corresponding web-server and process activity.

The controlled assessment introduces a test file into the monitored Apache directory, accesses it through the laboratory HTTP service, and reviews whether the resulting file-integrity and process activity are detected and correlated.

Critical Apache web-server directories should be continuously monitored for unexpected file creation, modification, deletion, and permission changes.

File integrity monitoring establishes and checks the expected state of important web-server files and directories. By analyzing file-change events alongside relevant process activity, security monitoring can help identify potential web-shell deployment and support a timely response.

The secure processing flow is: