Post 89 - Sprint 2 continues

31 Dec 2025

Day 15 Web Attack Forensics Drone Alone

Looking at webserver error logs, be alert for errors like 500 “Internal Server Error”. That often indicates an attackers input was processed by the server but failed during execution. This also helps determine if an attacker reached the backend or remained at the web layer.

When going through sysmon logs, look for Apache spawning system processes like cmd.exe or powershell.exe.