Cross-source coverage

T1505.003 / ATT&CK

Server Software Component: Web Shell

95 rules across 8 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).

Tactics
Persistence
Platforms
Linux · macOS · Network Devices · Windows
Telemetry
WinEventLog:SysmonWinEventLog:SecurityNSM:Flowauditd:SYSCALLmacos:unifiedlog

How MITRE says to detect it DET0394

Web Shell Detection via Server Behavior and File Execution Chains

Windows Analytic 1108

Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)

  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Security EventCode=4624, 4648
  • NSM:Flow Inbound HTTP POST with suspicious payload size or user-agent

Linux Analytic 1109

File creation of unauthorized script (e.g.,.php,.sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx

  • auditd:SYSCALL new file created in /var/www/html, /srv/http, or similar web root
  • auditd:SYSCALL apache2 or nginx spawning sh, bash, or python interpreter
  • NSM:Flow POST requests to .php, .jsp, .aspx files with high entropy body

macOS Analytic 1110

Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www

  • macos:unifiedlog httpd spawning bash, zsh, python, or osascript
  • auditd:SYSCALL file write operations in /Library/WebServer/Documents

SigmaHQ/sigma

35 rules
Detection Severity Format
Certificate Request Export to Exchange Webserver Critical Sigma
CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit Critical Sigma
Mailbox Export to Exchange Webserver Critical Sigma
Oracle WebLogic Exploit Critical Sigma
Solarwinds SUPERNOVA Webshell Access Critical Sigma
Webshell Remote Command Execution Critical Sigma
WordPress Wp2shell Webshell Plugin Access Critical Sigma
Antivirus - Web Shell Detection Signature High Sigma
Chopper Webshell Process Pattern High Sigma
Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790) High Sigma

+ 25 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

24 rules
Detection Severity Format
Microsoft Exchange Worker Spawning Suspicious Processes High Elastic TOML
Potential SAP NetWeaver Exploitation High Elastic TOML
Potential SAP NetWeaver WebShell Creation High Elastic TOML
Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation High Elastic TOML
ScreenConnect Server Spawning Suspicious Processes High Elastic TOML
Web Server Exploitation Detected via Defend for Containers High Elastic TOML
Web Shell Detection: Script Process Child of Common Web Processes High Elastic TOML
Windows Server Update Service Spawning Suspicious Processes High Elastic TOML
Initial Access via File Upload Followed by GET Request Medium Elastic TOML
Microsoft Exchange Server UM Writing Suspicious Files Medium Elastic TOML

+ 14 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

19 rules
Detection Severity Format
Cisco Configuration Archive Logging Analysis Undefined SPL
Cisco Secure Firewall - Privileged Command Execution via HTTP Undefined SPL
Detect Exchange Web Shell Undefined SPL
Exploit Public Facing Application via Apache Commons Text Undefined SPL
MS Exchange Mailbox Replication service writing Active Server Pages Undefined SPL
Spring4Shell Payload URL Request Undefined SPL
Supernova Webshell Undefined SPL
Tomcat Session Deserialization Attempt Undefined SPL
Tomcat Session File Upload Attempt Undefined SPL
Web JSP Request via URL Undefined SPL

+ 9 more from splunk/security_content → showing the 10 highest-severity

elastic/protections-artifacts

6 rules
Detection Severity Format
Payload Downloaded via Curl or Wget by Web Server Undefined Elastic TOML
Payload Execution by Node.js Web Server Undefined Elastic TOML
Payload Execution by Web Server Undefined Elastic TOML
Potential Remote Code Execution via URL Encoded Payload Undefined Elastic TOML
Suspicious File Creation via Web Server Undefined Elastic TOML
Suspicious Web Server Child Process Undefined Elastic TOML

Wazuh Core Ruleset

4 rules
Detection Severity Format
file. Medium Wazuh XML
Simple shell.php command execution. Medium Wazuh XML
Squid: Attempt to access a worm/trojan related site. Medium Wazuh XML
TimThumb backdoor access attempt. Medium Wazuh XML

chronicle/detection-rules

4 rules
Detection Severity Format
ttp_windows_sharepoint_cve_2025_53770_webshell_succeeded Critical YARA-L
ttp_windows_sharepoint_cve_2025_53770_webshell_attempted High YARA-L
ttp_windows_suspicious_filewrites_to_sharepoint_layouts High YARA-L
ttp_windows_webserver_process_potential_webshell_execution Medium YARA-L

Bert-JanP/Hunting-Queries-Detection-Rules

2 rules
Detection Severity Format
MITRE ATT&CK Mapping Undefined KQL
Possible webshell on the endpoint Undefined KQL

falcosecurity/rules

1 rule
Detection Severity Format
Web Server Spawned Shell Critical Falco YAML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.