Cross-source coverage
T1505.003 / ATT&CK
Server Software Component: Web Shell
95 rules across 8 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).
- Tactics
- Persistence
- Platforms
- Linux · macOS · Network Devices · Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:SecurityNSM:Flowauditd:SYSCALLmacos:unifiedlog
How MITRE says to detect it DET0394
Web Shell Detection via Server Behavior and File Execution Chains
Windows Analytic 1108
Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)
WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=1WinEventLog:SecurityEventCode=4624, 4648NSM:FlowInbound HTTP POST with suspicious payload size or user-agent
Linux Analytic 1109
File creation of unauthorized script (e.g.,.php,.sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx
auditd:SYSCALLnew file created in /var/www/html, /srv/http, or similar web rootauditd:SYSCALLapache2 or nginx spawning sh, bash, or python interpreterNSM:FlowPOST requests to .php, .jsp, .aspx files with high entropy body
macOS Analytic 1110
Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www
macos:unifiedloghttpd spawning bash, zsh, python, or osascriptauditd:SYSCALLfile write operations in /Library/WebServer/Documents
SigmaHQ/sigma
35 rules| Detection | Severity | Format |
|---|---|---|
| Certificate Request Export to Exchange Webserver | Critical | Sigma |
| CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit | Critical | Sigma |
| Mailbox Export to Exchange Webserver | Critical | Sigma |
| Oracle WebLogic Exploit | Critical | Sigma |
| Solarwinds SUPERNOVA Webshell Access | Critical | Sigma |
| Webshell Remote Command Execution | Critical | Sigma |
| WordPress Wp2shell Webshell Plugin Access | Critical | Sigma |
| Antivirus - Web Shell Detection Signature | High | Sigma |
| Chopper Webshell Process Pattern | High | Sigma |
| Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790) | High | Sigma |
+ 25 more from SigmaHQ/sigma → showing the 10 highest-severity
elastic/detection-rules
24 rules| Detection | Severity | Format |
|---|---|---|
| Microsoft Exchange Worker Spawning Suspicious Processes | High | Elastic TOML |
| Potential SAP NetWeaver Exploitation | High | Elastic TOML |
| Potential SAP NetWeaver WebShell Creation | High | Elastic TOML |
| Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation | High | Elastic TOML |
| ScreenConnect Server Spawning Suspicious Processes | High | Elastic TOML |
| Web Server Exploitation Detected via Defend for Containers | High | Elastic TOML |
| Web Shell Detection: Script Process Child of Common Web Processes | High | Elastic TOML |
| Windows Server Update Service Spawning Suspicious Processes | High | Elastic TOML |
| Initial Access via File Upload Followed by GET Request | Medium | Elastic TOML |
| Microsoft Exchange Server UM Writing Suspicious Files | Medium | Elastic TOML |
+ 14 more from elastic/detection-rules → showing the 10 highest-severity
splunk/security_content
19 rules| Detection | Severity | Format |
|---|---|---|
| Cisco Configuration Archive Logging Analysis | Undefined | SPL |
| Cisco Secure Firewall - Privileged Command Execution via HTTP | Undefined | SPL |
| Detect Exchange Web Shell | Undefined | SPL |
| Exploit Public Facing Application via Apache Commons Text | Undefined | SPL |
| MS Exchange Mailbox Replication service writing Active Server Pages | Undefined | SPL |
| Spring4Shell Payload URL Request | Undefined | SPL |
| Supernova Webshell | Undefined | SPL |
| Tomcat Session Deserialization Attempt | Undefined | SPL |
| Tomcat Session File Upload Attempt | Undefined | SPL |
| Web JSP Request via URL | Undefined | SPL |
+ 9 more from splunk/security_content → showing the 10 highest-severity
elastic/protections-artifacts
6 rules| Detection | Severity | Format |
|---|---|---|
| Payload Downloaded via Curl or Wget by Web Server | Undefined | Elastic TOML |
| Payload Execution by Node.js Web Server | Undefined | Elastic TOML |
| Payload Execution by Web Server | Undefined | Elastic TOML |
| Potential Remote Code Execution via URL Encoded Payload | Undefined | Elastic TOML |
| Suspicious File Creation via Web Server | Undefined | Elastic TOML |
| Suspicious Web Server Child Process | Undefined | Elastic TOML |
Wazuh Core Ruleset
4 rules| Detection | Severity | Format |
|---|---|---|
| file. | Medium | Wazuh XML |
| Simple shell.php command execution. | Medium | Wazuh XML |
| Squid: Attempt to access a worm/trojan related site. | Medium | Wazuh XML |
| TimThumb backdoor access attempt. | Medium | Wazuh XML |
chronicle/detection-rules
4 rules| Detection | Severity | Format |
|---|---|---|
| ttp_windows_sharepoint_cve_2025_53770_webshell_succeeded | Critical | YARA-L |
| ttp_windows_sharepoint_cve_2025_53770_webshell_attempted | High | YARA-L |
| ttp_windows_suspicious_filewrites_to_sharepoint_layouts | High | YARA-L |
| ttp_windows_webserver_process_potential_webshell_execution | Medium | YARA-L |
Bert-JanP/Hunting-Queries-Detection-Rules
2 rules| Detection | Severity | Format |
|---|---|---|
| MITRE ATT&CK Mapping | Undefined | KQL |
| Possible webshell on the endpoint | Undefined | KQL |
falcosecurity/rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Web Server Spawned Shell | Critical | Falco YAML |