Usually, evidence of an attack involves direct access to “hidden” or unusual files, access to the administration area with or without authentication. remote code execution, SQL injection, file inclusion, cross-site scripting (XSS) and other unusual behavior that might indicate vulnerability scanning or reconnaissance,