Analyzing web shell attack type with windows forensic techniques

Today, with the rapid spread of communication technologies and the increase in internet use, cyber attacks are increasing day by day. As a result of cyber attacks; Institutions experience great losses such as financial and reputational loss. The late detection of cyber attacks, the competence of analysts and the disruptions in the data separation process increase the damage size of the attacks. Therefore, early detection of attacks is important. Especially after gaining access to the systems, there are groups that can remain unnoticed for years in the system for a long time. These groups are called APT (Advanced Persistent Threat) groups and frequently use the web shell attack type. Attackers have the opportunity to access the target system with more than one shell installation method. In systems with shell file code installed, attackers can perform malicious activities on systems with access privileges. The aim of this thesis is to include the precautions that can be taken and what actions can be taken by the people in the world of cyber security and who are interested in this field, when they encounter a web shell attack. In this thesis, it is explained how it is analyzed and detected on Windows systems after web Shell is installed on a system, and how the analysis should be carried out in terms of forensic computing is revealed. In the application part of the thesis, after the attack, the shell was uploaded with the file upload method and the image of the system was analyzed. All of the analysis methods used during the study are open source and free software.