Log activity from malware
Hello,
Which log can I look for detailed information about adding a file to a specific directory in an application?
The file obviously appears in the file manager, for example, but where should I look for logs of such file additions?
I'm talking about the IP address, when the file was uploaded, and what channel (in this case, File Manager from cPanel).
I know where to look for this information with FTP or SSH, but File Manager is a problem.
I'm primarily interested in situations where, for example, malware was added, e.g., through a plugin vulnerability, but also why a file was sometimes overwritten or changed, etc.
-
Hey there! I don't think you're going to have that level of detail available from File Manage access, but there are still helpful clues in the cPanel access log (/usr/local/cpanel/logs/access_log) that you may find useful.
When someone accesses cPanel >> File Manager, this is the log entry there:
12.34.56.78 - cpanel-username [08/24/2026:14:14:12 -0000] "GET /cpsess5222507348/frontend/jupiter/filemanager/index.html HTTP/1.1" 200 0 "https://98.76.54.32:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0" "s" "-" 2083
If someone clicks the "Upload" button to upload a file inside File Manager, you'll see this log entry there:
12.34.56.78 - cpanel-username [08/24/2026:14:16:03 -0000] "GET /cpsess5222507348/frontend/jupiter/filemanager/upload-ajax.html?file=&fileop=&dir=%2Fhome%2Fusername&dirop=&charset=&file_charset=&baseurl=&basedir= HTTP/1.1" 200 0 "https://98.76.54.32:2083/cpsess5222507348/frontend/jupiter/filemanager/index.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0" "s" "-" 2083
And if the user uploads a file you'll see an entry similar to this:
12.34.56.78 - cpanel-username [08/24/2026:14:17:18 -0000] "POST /cpsess5222507348/execute/Fileman/upload_files HTTP/1.1" 200 0 "https://98.76.54.32:2083/cpsess5222507348/frontend/jupiter/filemanager/upload-ajax.html?file=&fileop=&dir=%2Fhome%2Fusername&dirop=&charset=&file_charset=&baseurl=&basedir=" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0" "s" "-" 2083
In all these examples 12.34.56.78 is the user's IP they are connecting from and 98.76.54.32 is the server's IP address.
Let me know if that helps!
0 -
Hello,
Thanks! That's what i need, but there are no logs whether someone, for example, right-clicked on the "edit" file or clicked the "delete" file option?
0 -
I do see logs for those actions on my system. Here's what right click >> Edit looks like:
12.34.56.78 - cpanel-username [08/27/2026:17:45:36 -0000] "GET /cpsess5343363616/frontend/jupiter/filemanager/editit.html?file=400.shtml&fileop=&dir=%2Fhome%2Fusername%2Fpublic_html&dirop=&charset=&file_charset=_DETECT_&baseurl=&basedir=&edit=1 HTTP/1.1" 200 0 "https://98.76.54.32:2083/cpsess5343363616/frontend/jupiter/filemanager/index.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0" "s" "-" 2083
"Delete" isn't as obvious as it doesn't need to open a separate window like Edit does, but it does make a log entry for the page refresh after the file is deleted:
12.34.56.78 - cpanel-username [08/27/2026:17:47:22 -0000] "POST /cpsess5343363616/json-api/cpanel HTTP/1.1" 200 0 "https://98.76.54.32:2083/cpsess5343363616/frontend/jupiter/filemanager/index.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0" "s" "-" 2083
0
Please sign in to leave a comment.
Comments
3 comments