### Overview
Following the initial access via ProxyLogon Zero-Day exploit, our systems have identified the deployment of a web shell, specifically **China Chopper**.

### Details
- **Web Shell Name**: China Chopper
- **Behavior**: Provides attackers with remote access and control over the compromised server.
- **Indicators of Compromise (IoCs)**: Presence of unusual web application files.

### Next Steps
Focus on identifying the source of the web shell and potential attackers. Prepare for potential credential theft attempts, which are commonly executed following web shell deployment.