A
web shell is a malicious script uploaded to a web server (via file upload vulnerability or RCE) that provides browser-accessible command execution — persistent backdoor.
Web shells are notoriously hard to detect (small, often obfuscated files). FIM (File Integrity Monitoring) detects new/modified web files. Common in compromised WordPress and Drupal sites. Look for unusual .php files in upload directories.