The SOC files: Chasing the web shell

This SOC case study describes detection and analysis of a Behinder (Rebeyond/冰蝎) ASPX web shell compromising a government SharePoint server; attackers used certutil with Bashupload to drop payloads, loaded .NET modules in-memory to maintain encrypted C2 and operator control, and achieved SYSTEM via Potato family privilege-escalation tools. The report provides static/memory analysis artifacts, a YARA rule, file/hash IOCs, and practical detection guidance for defenders.