T1505.003 Web Shell
Sub-technique of T1505 Server Software Component
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation:…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploitcriticaltest · webserver
- Certificate Request Export to Exchange Webservercriticaltest · windows
- Mailbox Export to Exchange Webservercriticaltest · windows
- Oracle WebLogic Exploitcriticaltest · webserver
- Solarwinds SUPERNOVA Webshell Accesscriticaltest · webserver
- Webshell Remote Command Executioncriticaltest · linux
- Antivirus - Web Shell Detection Signaturehightest · antivirus
- Chopper Webshell Process Patternhightest · windows
- DEWMODE Webshell Accesshightest · webserver
- Exchange Set OabVirtualDirectory ExternalUrl Propertyhightest · windows
- Linux Webshell Indicatorshightest · linux
- MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Requesthightest · webserver
- Rejetto HTTP File Server RCEhightest · webserver
- Shellshock Expressionhightest · linux
- Suspicious ASPX File Drop by Exchangehightest · windows
- Suspicious Child Process Of SQL Serverhightest · windows
- Suspicious MSExchangeMailboxReplication ASPX Writehightest · windows
- Suspicious Process By Web Server Processhightest · windows
- Suspicious Windows Strings In URIhightest · webserver
- Webshell Detection With Command Line Keywordshightest · windows
- Webshell Hacking Activity Patternshightest · windows
- Webshell ReGeorg Detection Via Web Logshightest · webserver
- Webshell Tool Reconnaissance Activityhightest · windows
- Windows Webshell Stringshightest · webserver
- Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)highexperimental · windows
Showing 25 of 33.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.