EXPLORE
← Back to Explore
T1505.003

Web Shell

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW) In addition to a server-side script, a Web shell may have a client interface program that i...

LinuxmacOSNetwork DevicesWindows
57
Detections
3
Sources
31
Threat Actors

BY SOURCE

23sigma19elastic15splunk_escu

PROCEDURES (33)

General Monitoring7 detections

Auto-extracted: 7 detections for general monitoring

Suspicious5 detections

Auto-extracted: 5 detections for suspicious

Process Creation Monitoring4 detections

Auto-extracted: 4 detections for process creation monitoring

Suspicious3 detections

Auto-extracted: 3 detections for suspicious

Privilege3 detections

Auto-extracted: 3 detections for privilege

Unusual3 detections

Auto-extracted: 3 detections for unusual

Http2 detections

Auto-extracted: 2 detections for http

Service2 detections

Auto-extracted: 2 detections for service

Http2 detections

Auto-extracted: 2 detections for http

Exfiltrat2 detections

Auto-extracted: 2 detections for exfiltrat

Suspicious2 detections

Auto-extracted: 2 detections for suspicious

Email1 detections

Auto-extracted: 1 detections for email

Unusual1 detections

Auto-extracted: 1 detections for unusual

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Inject1 detections

Auto-extracted: 1 detections for inject

Remote1 detections

Auto-extracted: 1 detections for remote

Credential1 detections

Auto-extracted: 1 detections for credential

Credential1 detections

Auto-extracted: 1 detections for credential

Lateral1 detections

Auto-extracted: 1 detections for lateral

Remote1 detections

Auto-extracted: 1 detections for remote

Powershell1 detections

Auto-extracted: 1 detections for powershell

Script Execution Monitoring1 detections

Auto-extracted: 1 detections for script execution monitoring

Powershell1 detections

Auto-extracted: 1 detections for powershell

Privilege1 detections

Auto-extracted: 1 detections for privilege

Lateral1 detections

Auto-extracted: 1 detections for lateral

Http1 detections

Auto-extracted: 1 detections for http

Email1 detections

Auto-extracted: 1 detections for email

Service1 detections

Auto-extracted: 1 detections for service

File Monitoring1 detections

Auto-extracted: 1 detections for file monitoring

Remote1 detections

Auto-extracted: 1 detections for remote

Network Connection Monitoring1 detections

Auto-extracted: 1 detections for network connection monitoring

Child Process1 detections

Auto-extracted: 1 detections for child process

Child Process1 detections

Auto-extracted: 1 detections for child process

DETECTIONS (57)

Antivirus Web Shell Detection
sigmahigh
Certificate Request Export to Exchange Webserver
sigmacritical
Chopper Webshell Process Pattern
sigmahigh
Cisco Configuration Archive Logging Analysis
splunk_escu
Cisco Secure Firewall - Privileged Command Execution via HTTP
splunk_escu
Detect Exchange Web Shell
splunk_escu
Exchange Set OabVirtualDirectory ExternalUrl Property
sigmahigh
Exploit Public Facing Application via Apache Commons Text
splunk_escu
IIS Native-Code Module Command Line Installation
sigmamedium
Initial Access via File Upload Followed by GET Request
elasticmedium
Linux Webshell Indicators
sigmahigh
Mailbox Export to Exchange Webserver
sigmacritical
Microsoft Exchange Server UM Writing Suspicious Files
elasticmedium
Microsoft Exchange Worker Spawning Suspicious Processes
elastichigh
MS Exchange Mailbox Replication service writing Active Server Pages
splunk_escu
Potential SAP NetWeaver Exploitation
elastichigh
Potential SAP NetWeaver WebShell Creation
elastichigh
Potential Web Shell ASPX File Creation
elasticmedium
Potential Webshell Creation On Static Website
sigmamedium
Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation
elastichigh
ScreenConnect Server Spawning Suspicious Processes
elastichigh
Shellshock Expression
sigmahigh
Simple HTTP Web Server Connection
elasticlow
Simple HTTP Web Server Creation
elasticlow
Spring4Shell Payload URL Request
splunk_escu
Supernova Webshell
splunk_escu
Suspicious ASPX File Drop by Exchange
sigmahigh
Suspicious Child Execution via Web Server
elasticmedium
Suspicious Child Process Of SQL Server
sigmahigh
Suspicious File Drop by Exchange
sigmamedium
Suspicious File Write to SharePoint Layouts Directory
sigmahigh
Suspicious File Write to Webapps Root Directory
sigmamedium
Suspicious MSExchangeMailboxReplication ASPX Write
sigmahigh
Suspicious Process By Web Server Process
sigmahigh
Suspicious Windows Strings In URI
sigmahigh
Tomcat Session Deserialization Attempt
splunk_escu
Tomcat Session File Upload Attempt
splunk_escu
Uncommon Destination Port Connection by Web Server
elasticlow
Unusual Command Execution from Web Server Parent
elasticlow
Unusual Process Spawned from Web Server Parent
elasticlow
Unusual Web Server Command Execution
elasticmedium
Web JSP Request via URL
splunk_escu
Web Server Exploitation Detected via Defend for Containers
elastichigh
Web Server Potential Command Injection Request
elasticlow
Web Shell Detection: Script Process Child of Common Web Processes
elastichigh
Webshell Detection With Command Line Keywords
sigmahigh
Webshell Hacking Activity Patterns
sigmahigh
Webshell ReGeorg Detection Via Web Logs
sigmahigh
Webshell Remote Command Execution
sigmacritical
Webshell Tool Reconnaissance Activity
sigmahigh
Windows Server Update Service Spawning Suspicious Processes
elastichigh
Windows SharePoint Spinstall0 GET Request
splunk_escu
Windows SharePoint Spinstall0 Webshell File Creation
splunk_escu
Windows SharePoint ToolPane Endpoint Exploitation Attempt
splunk_escu
Windows Suspicious Child Process Spawned From WebServer
splunk_escu
Windows Webshell Strings
sigmahigh
Windows WSUS Spawning Shell
splunk_escu