From the request to the consequence. No gaps.

It captures the code at the exact moment the interpreter compiles it, already free of obfuscation. Then it checks two things at once: that a real fragment of what the user sent reached the dangerous argument —not a chance match— and what intent that code has, using an engine embedded in the agent that scores by what the code does. The file at rest is handled by the content antivirus engine as soon as the webshell touches disk. And in parallel the web process itself is seen opening a system shell.

The seven classes of dangerous operation —execute, include, deserialise, write file, SQL query, Redis commands and MongoDB queries— are observed at the point of use, with their value already resolved. The analysis is by value: a real fragment of the user's input must actually reach the dangerous argument, which is why obfuscating the request is useless. No class is left out: the design itself makes it impossible to add a dangerous point without deciding how it is judged.

SHIELD reads the query inside the server, at the point where the application hands it to the data engine —before encryption wraps it— and recognises the protocol by its own shape, so it works just as well on non-standard ports and with libraries whose names are not visible. On that text it applies the same by-value analysis: it flags when the user's input breaks the structure of the query, which is what tells an injection apart from ordinary data. It also sees extraction: when, after a suspicious payload, the database starts dumping records outward.

It observes the exact operations of a fileless attack: creating executable memory and launching it without touching disk, writing into another process's memory, asking for memory that is writable and executable at once (the shellcode signature), or loading a program into the system kernel itself. All of it from the web lineage, which should never do any of this.

Every write is resolved to its real path —proof against symbolic links and detours through the directory tree— and compared against the known persistence locations: remote-access keys, scheduled tasks, boot services, system accounts and preload hooks. It only counts if it comes from the web process; the administrator's legitimate maintenance is exempt.

It keeps each process's history and correlates within a bounded window: external download → file marked executable → its execution; webshell → outbound connection; webshell → database write; webshell → data exfiltration by volume; and the quietest case of all, the file the application itself writes and then executes, even if it tries to disguise the path. On top of that it builds the attacker's campaign in the industry's standard stages (access, execution, persistence, command and control, exfiltration), aggregating all their incidents under one actor even when they arrive through different requests.

The outbound connection is denied on the spot if the account is quarantined or the IP is on the block list (a single table covering IPv4 and IPv6, where allow beats block). The inbound packet is dropped by its source IP at the earliest possible point, before it enters the network stack. The client's real IP is extracted from the protocol itself, even with a proxy in front, and attributed to the right request — not to the wrong process. And it flags the connections the application opens towards forbidden internal destinations, the classic pattern of cloud credential theft.

It learns, account by account, which chains of actions are normal, and scores the rarity of each step, not its frequency. The threshold self-calibrates after an observation period; the model updates itself, but it never learns as normal something it already flagged as anomalous, so an attacker cannot acclimatise it little by little.

It kills the process anchored to its real identity, so it cannot reach another through identifier reuse. It isolates the account with a lock inside the kernel that cuts off its execution and network, without touching its neighbours. And it neutralises the file by moving it out of where it is served or making it unusable, always keeping how to undo it; if it cannot, it says so instead of pretending it contained. The golden rule ships from the factory: containment demands a certainty signal —a deterministic rule, or a file whose verdict is so high that the antivirus itself escalates to reversible containment—; whatever only a model or behaviour has an opinion about stays a warning, and can only reach containment if you enable it and two independent sources agree.