During an incident involving a compromised web server, the team discovers a PHP webshell at '/var/www/html/uploads/image.php'. What containment and remediation steps are required?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because proper remediation requires understanding the full attack chain — how the webshell was uploaded (often an unrestricted file upload vulnerability), whether the attacker established additional persistence, and patching the root cause — not just removing the visible artifact. A is wrong because deleting the webshell without identifying the upload vulnerability leaves the system re-exploitable; it also destroys evidence before forensic analysis.
Full explanation below image
Full Explanation
B is correct because proper remediation requires understanding the full attack chain — how the webshell was uploaded (often an unrestricted file upload vulnerability), whether the attacker established additional persistence, and patching the root cause — not just removing the visible artifact. A is wrong because deleting the webshell without identifying the upload vulnerability leaves the system re-exploitable; it also destroys evidence before forensic analysis. C is wrong because changing the listening port only obscures the service temporarily; the webshell and underlying vulnerability remain. D is wrong because leaving a webshell active for intelligence gathering without proper controls puts the organization at continued risk and may violate legal obligations.