How to detect webshell via splunk

[ad761]

Hi,

I would like to know how I can detect a webshell via Splunk.

I hope there is a doc that can help me to write a ( detect webshell queries )

Thanks.

[ad761]

any help for that !