A suspected WebShell is awkward because the first clue is often weak. You may have one odd request in an access log, one newly modified file under a web root, a process running as the web user, or an outbound connection that does not fit the service. The dangerous move is to jump straight into cleanup. Before deleting files or restarting services, a responder needs a small evidence map: what request or path started the suspicion whether related files changed recently whether the web user has unusual processes whether those processes have network connections whether persistence or scheduled tasks changed nearby whether auth logs show a related login or privilege event what evidence is still missing That is the point where local, read-only AI can be useful. Start from the web root, not a verdict A practical first pass can start with the web root and recent time window: oi web --root /var/www -s 7d Enter fullscreen mode Exit fullscreen mode The goal is not to ask AI to decide whether the host is compromised.…