A few months ago, I wrote a diary about webshells[
Article Link: https://isc.sans.edu/diary.html?storyid=22410&rss