Web shell
Named by 7 kept items in this workspace.
6 items name it under classification.key entities and 1 under tools.
Search every workspace for Web shell. It matches the name as written, so it can find other things that share it.
The items that name it 7
deployed by the threat actor onto security appliance B to establish a Command-and-Control (C2) connection, per Mandiant
All technologies in this workspace.