How do you detect edge-device compromise and web shells?

Because edge appliances cannot run EDR, detection relies on their own logs (centralised off-box), network telemetry and lateral-movement artifacts. Alert on unexpected web shells and anomalous POSTs to admin paths, configuration or firmware drift, disabled logging, and new local admins or SSH authorized_keys. Run vendor integrity-checker tools but do not trust a clean result, since implants survive upgrades. Hunt post-exploitation signals such as the Impacket wmiexec output file in ADMIN$ with an epoch-timestamp name and the Chisel server's 'SSH-chisel-v3-server' handshake banner.

Detecting Edge-Device Exploitation and Web Shells

Edge devices — the Ivanti, Fortinet, Citrix and Cisco appliances attackers favour — cannot run EDR, so detection relies on the device’s own (often sparse) logs, network telemetry, and the artifacts of the lateral movement that follows. This pack covers web-shell and config-tamper detection and the post-exploitation traces of tools like Impacket and Chisel.

Signals at a Glance

Stage	Primary signal	Technique
Exploitation	Unexpected web shell on the appliance; anomalous POSTs to admin paths	T1190 T1505.003
Persistence/evasion	Config/firmware drift; logging disabled; new admin or SSH key	T1601 T1070
Lateral movement (Impacket)	wmiexec output file in ADMIN$ with an epoch-timestamp name; service installs	T1021.002 T1569.002
Tunneling (Chisel)	HTTP 101 upgrade with the `SSH-chisel-v3-server` banner; long-lived outbound WebSocket	T1572

Appliance Signals

Centralise and retain appliance logs off-box (they are sparse and attackers disable them); baseline configurations and alert on drift, new local admins, and added SSH authorized_keys.
Run the vendor integrity-checker tools, but do not treat a clean result as proof — implants on Ivanti and others survive upgrades. Hunt on the no-EDR surfaces (appliances, vCenter/ESXi) directly.
For Cisco IOS XE, hunt for unexpected priv-15 accounts and use the vendor’s implant check; for Citrix Bleed, correlate session reuse from new IPs after patching (stolen tokens stay valid until sessions are killed).

Network & Lateral-Movement Artifacts

Two high-fidelity network/host signals of post-exploitation:

// Impacket wmiexec output artifact (host/file telemetry)
//   File created in C:\Windows\ (ADMIN$) matching:  __.
//   e.g.  \\TARGET\ADMIN$\__1700000000.12345

// Chisel server handshake (Suricata / network)
//   HTTP 101 Switching Protocols response body contains:
//       SSH-chisel-v3-server
//   plus a long-lived outbound WebSocket from an uncommon parent process

Vetted sources

Emerging Threats/Suricata ship the Chisel banner signature; Elastic and SigmaHQ cover Impacket lateral movement (the ADMIN$ epoch artifact) and web-shell patterns; YARA rules for Chisel match the embedded Go module path github.com/jpillora/chisel to catch renamed binaries.

See Into the No-EDR Surfaces

Mjolnir Security helps organisations detect edge-device compromise and the pivots that follow.

Detection EngineeringNetwork DetectionManaged Detection & ResponseCompromise AssessmentIncident Response

Detection Engineering Building appliance-log and network detections for edge intrusions.
Compromise Assessment Hunting for web shells and implants on no-EDR surfaces.
24/7 Incident Response Containment when edge-device compromise is suspected. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 12, 2026

Signals at a Glance

Appliance Signals

Network & Lateral-Movement Artifacts

See Into the No-EDR Surfaces

Ivanti Connect Secure Exploitation

Impacket