Medusa GroupG1051 ↗
Has utilized webshells to an exploited Microsoft Exchange Server.1
- Tactic
- Persistence
- Platforms
- Linux, macOS, Network Devices, Windows
- Version
- 1.5
- Created
- 13 December 2019
- Last modified
- 12 May 2026
- Contributor
- Arnim Rupp, Deutsche Lufthansa AG
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
31
Threat groupsTop 5%
Threat groups95th percentile · 95% of ATT&CK techniques have this many threat groups attributed or fewer.13
CampaignsTop 2%
Campaigns98th percentile · 98% of ATT&CK techniques have this many campaigns recorded or fewer.22
Tools & malwareTop 16%
Tools & malware84th percentile · 84% of ATT&CK techniques have this many tools implementing them or fewer.54
Detection rulesTop 4%
Detection rules96th percentile · 96% of ATT&CK techniques have this many detection rules written or fewer.Web Shell MITRE reference T1505.003
Top 5%of all ATT&CK techniques for number of groups
31 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
BlackByteG1043 ↗
Has used ASPX web shells following exploitation of vulnerabilities in services such as Microsoft Exchange.12
Sea TurtleG1041 ↗
Deployed the SnappyTCP web shell during intrusion operations.12
AgriusG1030 ↗
Typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.1
APT5G1023 ↗
Has installed multiple web shells on compromised servers including on Pulse Secure VPN appliances.12
Volt TyphoonG1017 ↗
Has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.1
All 31 groups for this technique · 6 newest in this preview
13 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SharePoint ToolShell ExploitationC0058 ↗
During SharePoint ToolShell Exploitation, threat actors followed exploitation of SharePoint servers with installation of a malicious .aspx web shell (spinstall0.aspx) that was written to the _layouts/15/ directory, granting persistent HTTP-based access.123456
Operation Digital EyeC0061 ↗
During Operation Digital Eye, threat actors deployed a PHP-based webshell to maintain persistent access.1
Versa Director Zero Day ExploitationC0039 ↗
Resulted in the deployment of the VersaMem web shell for follow-on activity.1
FrostyGoop IncidentC0041 ↗
Deployed a ReGeorg variant web shell to impacted systems following initial access for persistence.1
Cutting EdgeC0029 ↗
During Cutting Edge, threat actors used multiple web shells to maintain presence on compromised Connect Secure appliances such as WIREFIRE, GLASSTOKEN, BUSHWALK, LIGHTWIRE, and FRAMESTING.12
APT41 DUSTC0040 ↗
Involved use of web shells such as ANTSWORD and BLUEBEAM for persistence.1
All 13 campaigns for this technique · 6 newest in this preview
22 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
PHPsertS9028 ↗
Can use the .php assert function to execute attacker-provided code and maintain persistence on targeted web servers.1
SPAWNCHIMERAS9024 ↗
Has created web shells that facilitate actions on the victim host.1
PHASEJAMS9014 ↗
Has inserted Perl-based web shells into legitimate files that provided threat actors with remote access and code execution capabilities on the compromised network appliance.1
Neo-reGeorgS1189 ↗
Can be installed on compromised web servers to tunnel C2 connections.12
Line RunnerS1188 ↗
Is a persistent Lua-based web shell.1
reGeorgS1187 ↗
Is a web shell that has been installed on exposed web servers for access to victim environments.12
All 22 software entries for this technique · 6 newest in this preview
Offense vs defense T1505.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 13Sigma rules (cumulative) · 35Splunk ESCU (cumulative) · 19
first rule: 2017 Q1 · 13 of 13 campaigns plottedWeb Shell detection strategy DET0394
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Web Shell Detection via Server Behavior and File Execution Chains
3 platforms
AN1108 · Windows
Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Logon Session CreationDC0067 | WinEventLog:Security | EventCode=4624, 4648 |
| Network Traffic ContentDC0085 | NSM:Flow | Inbound HTTP POST with suspicious payload size or user-agent |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WebRootPath | Custom web server directory depending on IIS or third-party hosting environment |
| ParentProcess | Different server binaries (e.g., php-cgi.exe, apache.exe) that may launch scripts |
AN1109 · Linux
File creation of unauthorized script (e.g., .php, .sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | apache2 or nginx spawning sh, bash, or python interpreter |
| File CreationDC0039 | auditd:SYSCALL | new file created in /var/www/html, /srv/http, or similar web root |
| Network Traffic ContentDC0085 | NSM:Flow | POST requests to .php, .jsp, .aspx files with high entropy body |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WebRootPath | Web server root varies by distro and hosting configuration |
| PayloadEntropyThreshold | Base64 or XOR encoded shells may exceed this value |
| TimeWindow | Correlate file creation with process spawn within X seconds |
AN1110 · macOS
Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | httpd spawning bash, zsh, python, or osascript |
| File ModificationDC0061 | auditd:SYSCALL | file write operations in /Library/WebServer/Documents |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| InterpreterName | Adversary may use different scripting environments |
| ExecutionParent | Not all web servers are named httpd; may differ in custom deployments |
1 analytic
A web shell is a web script placed on an openly accessible web server to allow an adversary to use the server as a gatway in a network. As the shell operates, commands will be issued from within the web application into the broader server operating system. This analytic looks for host enumeration executables initiated by any web service that would not normally be executed within that environment.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | exe |
| process | create | parent_exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This is a pseudocode representation of the below splunk search.
processes = search Process:Create suspicious_processes = filter processes where ( (parent_exe == "w3wp.exe" OR parent_exe == "httpd.exe" OR parent_exe == "tomcat*.exe" OR parent_exe == "nginx.exe" ) AND (exe == "cmd.exe" OR exe == "powershell.exe" OR exe == "net.exe" OR exe == "whoami.exe" OR exe == "hostname.exe" OR exe == "systeminfo.exe" OR exe == "ipconfig.exe) ) output suspicious_processes
Look for host enumeration commands spawned by web services.
(index=__your_sysmon_index__ EventCode=1) (ParentImage="C:\\Windows\\System32\\*w3wp.exe" OR ParentImage="*httpd.exe" OR ParentImage="*tomcat*.exe" OR ParentImage="*nginx.exe") (Image="C:\\Windows\\System32\\cmd.exe OR Image="C:\\Windows\\SysWOW64\\cmd.exe" OR Image="C:\\Windows\\System32\\*\\powershell.exe OR Image="C:\\Windows\SysWOW64\\*\powershell.exe OR Image="C:\\Windows\\System32\\net.exe" OR Image="C:\\Windows\\System32\\hostname.exe" OR Image="C:\\Windows\\System32\\whoami.exe" OR Image="*systeminfo.exe OR Image="C:\\Windows\\System32\\ipconfig.exe")
Consider disabling functions from web technologies such as PHP’s evaI() that may be abused for web shells.
Enforce the principle of least privilege by limiting privileges of user accounts so only authorized accounts can modify the web directory.
Tests1Executorscmd 1Need elevation0 of 1Have prerequisites1Have cleanup1Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition