T1505.003 Web Shell | DetectionCode

About this technique

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).

Detection rules44

Rules on DetectionCode tagged with T1505.003.

Sigma23

Rule	Level	Log source
Certificate Request Export to Exchange Webserver	critical	windows / NULL
Mailbox Export to Exchange Webserver	critical	windows / NULL
Webshell Remote Command Execution	critical	linux / NULL
Antivirus - Web Shell Detection Signature	high	NULL / antivirus
Chopper Webshell Process Pattern	high	windows / process_creation
Exchange Set OabVirtualDirectory ExternalUrl Property	high	windows / NULL
Linux Webshell Indicators	high	linux / process_creation
Shellshock Expression	high	linux / NULL
Suspicious ASPX File Drop by Exchange	high	windows / file_event
Suspicious Child Process Of SQL Server	high	windows / process_creation
Suspicious File Write to SharePoint Layouts Directory	high	windows / file_event
Suspicious MSExchangeMailboxReplication ASPX Write	high	windows / file_event
Suspicious Process By Web Server Process	high	windows / process_creation
Suspicious Windows Strings In URI	high	NULL / webserver
Webshell Detection With Command Line Keywords	high	windows / process_creation
Webshell Hacking Activity Patterns	high	windows / process_creation
Webshell ReGeorg Detection Via Web Logs	high	NULL / webserver
Webshell Tool Reconnaissance Activity	high	windows / process_creation
Windows Webshell Strings	high	NULL / webserver
IIS Native-Code Module Command Line Installation	medium	windows / process_creation
Potential Webshell Creation On Static Website	medium	windows / file_event
Suspicious File Drop by Exchange	medium	windows / file_event
Suspicious File Write to Webapps Root Directory	medium	windows / file_event

Splunk21

Rule	Type	Risk	Data source
Cisco Configuration Archive Logging Analysis	Hunting	NULL	Cisco IOS Logs
Cisco Secure Firewall - Privileged Command Execution via HTTP	Anomaly	NULL	Cisco Secure Firewall Threat Defense Intrusion Event
Detect Exchange Web Shell	TTP	NULL	Sysmon EventID 11
Detect Webshell Exploit Behavior	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Exploit Public Facing Application via Apache Commons Text	Anomaly	NULL	Nginx Access
MS Exchange Mailbox Replication service writing Active Server Pages	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 11
Spring4Shell Payload URL Request	TTP	NULL	Nginx Access
Supernova Webshell	TTP	NULL
Tomcat Session Deserialization Attempt	Anomaly	NULL	Nginx Access
Tomcat Session File Upload Attempt	Anomaly	NULL	Nginx Access
W3WP Spawning Shell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Web JSP Request via URL	TTP	NULL	Nginx Access
Windows Metasploit Confluence Plugin Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Potential Web Shell Creation For VMware Workspace ONE	Anomaly	NULL	Sysmon EventID 11
Windows SharePoint Spinstall0 GET Request	TTP	NULL	Suricata
Windows SharePoint Spinstall0 Webshell File Creation	TTP	NULL	Sysmon EventID 11
Windows SharePoint ToolPane Endpoint Exploitation Attempt	TTP	NULL	Suricata
Windows Suspicious Child Process Spawned From WebServer	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows TeamCity Payload Execution from Temp Directory	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows TeamCity Plugin Installed	Anomaly	NULL	Sysmon EventID 11
Windows WSUS Spawning Shell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

Groups31

Show 7 more

Sandworm Team Sea Turtle Threat Group-3390 Tonto Team Tropic Trooper Volatile Cedar Volt Typhoon

Software22

Campaigns13

2022 Ukraine Electric Power Attack APT41 DUST C0017 C0032 Cutting Edge FrostyGoop Incident HomeLand Justice Leviathan Australian Intrusions Operation CuckooBees Operation Digital Eye Operation Wocao SharePoint ToolShell Exploitation Versa Director Zero Day Exploitation

Procedure examples66

Groups31

Used by	Procedure example
GroupAgrius	Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation. SentinelOne Agrius 2021
GroupAPT28	APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server. Cybersecurity Advisory GRU Brute Force Campaign July 2021
GroupAPT29	APT29 has installed web shells on exploited Microsoft Exchange servers. Cybersecurity Advisory SVR TTP May 2021 Mandiant APT29 Eye Spy Email Nov 22
GroupAPT32	APT32 has used Web shells to maintain access to victim websites. Volexity OceanLotus Nov 2017
GroupAPT38	APT38 has used web shells for persistence or to ensure redundant access. CISA AA20-239A BeagleBoyz August 2020
GroupAPT39	APT39 has installed ANTAK and ASPXSPY web shells. FireEye APT39 Jan 2019
GroupAPT5	APT5 has installed multiple web shells on compromised servers including on Pulse Secure VPN appliances. Mandiant Pulse Secure Update May 2021 Mandiant Pulse Secure Zero-Day April 2021
GroupBackdoorDiplomacy	BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system. ESET BackdoorDiplomacy Jun 2021

View all 31 groups examples

Software22

Used by	Procedure example
MalwareASPXSpy	ASPXSpy is a Web shell. The ASPXTool version used by Threat Group-3390 has been deployed to accessible servers running Internet Information Services (IIS). Dell TG-3390
MalwareBUSHWALK	BUSHWALK is a web shell that has the ability to execute arbitrary commands or write files. Mandiant Cutting Edge Part 2 January 2024
MalwareChina Chopper	China Chopper's server component is a Web Shell payload. Lee 2013
MalwareFRAMESTING	FRAMESTING is a web shell capable of enabling arbitrary command execution on compromised Ivanti Connect Secure VPNs. Mandiant Cutting Edge Part 2 January 2024
MalwareGLASSTOKEN	GLASSTOKEN is a web shell capable of tunneling C2 connections and code execution on compromised Ivanti Secure Connect VPNs. Volexity Ivanti Zero-Day Exploitation January 2024
MalwareLIGHTWIRE	LIGHTWIRE is a web shell capable of command execution and establishing persistence on compromised Ivanti Secure Connect VPNs. Mandiant Cutting Edge Part 2 January 2024
MalwareLine Runner	Line Runner is a persistent Lua-based web shell. CCCS ArcaneDoor 2024
MalwareNeo-reGeorg	Neo-reGeorg can be installed on compromised web servers to tunnel C2 connections. GitHub Neo-reGeorg 2019 Mandiant-Sandworm-Ukraine-2022

View all 22 software examples

Campaigns13

Used by	Procedure example
Campaign2022 Ukraine Electric Power Attack	During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server. Mandiant-Sandworm-Ukraine-2022
CampaignAPT41 DUST	APT41 DUST involved use of web shells such as ANTSWORD and BLUEBEAM for persistence. Google Cloud APT41 2024
CampaignC0017	During C0017, APT41 deployed JScript web shells through the creation of malicious ViewState objects. Mandiant APT41
CampaignC0032	During the C0032 campaign, TEMP.Veles planted Web shells on Outlook Exchange servers. FireEye TRITON 2019
CampaignCutting Edge	During Cutting Edge, threat actors used multiple web shells to maintain presence on compromised Connect Secure appliances such as WIREFIRE, GLASSTOKEN, BUSHWALK, LIGHTWIRE, and FRAMESTING. Mandiant Cutting Edge January 2024 Volexity Ivanti Zero-Day Exploitation January 2024
CampaignFrostyGoop Incident	FrostyGoop Incident deployed a ReGeorg variant web shell to impacted systems following initial access for persistence. Dragos FROSTYGOOP 2024
CampaignHomeLand Justice	For HomeLand Justice, threat actors used .aspx webshells named pickers.aspx, error4.aspx, and ClientBin.aspx, to maintain persistence. CISA Iran Albanian Attacks September 2022 Microsoft Albanian Government Attacks September 2022
CampaignLeviathan Australian Intrusions	Leviathan relied extensively on web shell use following initial access for persistence and command execution purposes in victim environments during Leviathan Australian Intrusions. CISA Leviathan 2024

View all 13 campaigns examples

References2

Lee 2013 Open source
Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015.
volexity_0day_sophos_FW Open source
Adair, S., Lancaster, T., Volexity Threat Research. (2022, June 15). DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach. Retrieved July 1, 2022.