Understanding the Initial Stages of Web Shell and VPN Threats: An MXDR Analysis