What happened was, a friend's company is using dated dot net nuke framework. A html page with 'hacked by xxxx' was found uploaded onto the web server.
Upon investigating, it is determined that a webshell was uploaded through exploiting a vulnerability and the 'hacked by xxxx' html page was 'created' using the web shell.
So technically the html file was created and not uploaded. The only thing uploaded was the web shell.
The website has WAF in place. Possibly a CDN(can't remember details).
Thing is, can WAF block/detect the file creation/upload through the web shell or does it just treat it like any other day to day upload/download activities.
Additionally I understand that WAF can block and detect web shell. But how about obfuscated ones?