ATT&CK coverage › Technique

Server Software Component: Web Shell T1505.003

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Events covered

3 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon11FileCreate
Security-Auditing4688A new process has been created.

Authoring guide

Patterns shared across the 16 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (8 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
Image12ends_with 11, eq 2\w3wp.exe, \ntdsutil.exe, \appcmd.exe, System, \wsl.exe
CommandLine9match 8, starts_with 1, ends_with 1&cd&echo, MSExchange, &c:&echo, &ipconfig&echo, -name:
TargetFilename9ends_with 5, match 4, in 2, starts_with 1, eq 1.aspx, .vbs, .jsp, "*\\HttpProxy\\OAB\\*", "*\\HttpProxy\\owa\\auth\\*"
ParentImage7ends_with 6, match 4, eq 1, starts_with 1\httpd.exe, \tomcat, \nginx.exe, \w3wp.exe, C:\Windows\System32\inetsrv\iissetup.exe
file_name3eq 2, in 1"*.aspx", "*.ashx", "spinstall0.aspx"
OriginalFileName2eq 2appcmd.exe, wmic.exe, schtasks.exe, quser.exe
ParentCommandLine1match 1catalina.jar, CATALINA_HOME, catalina.home
process_name1eq 1MSExchangeMailboxReplication.exe

Top indicator values (212 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
ParentImageends_with\w3wp.exe58
Imageends_with\w3wp.exe56
TargetFilenameends_with.aspx45
TargetFilenameends_with.asp44
Imageends_with\powershell.exe4143
Imageends_with\cmd.exe492
Imageends_with\pwsh.exe4140
ParentImagematch-tomcat-44
ParentImageends_with\caddy.exe44
ParentImageends_with\java.exe47
ParentImageends_with\httpd.exe46
ParentImagematch\tomcat46
ParentImageends_with\php-cgi.exe46
ParentImageends_with\javaw.exe45
ParentImageends_with\nginx.exe46
TargetFilenameends_with.ashx33
ParentImageends_with\ws_tomcatservice.exe33
CommandLinematchCATALINA_HOME33
CommandLinematchcatalina.jar33
CommandLinematch&cd&echo22

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 13 rules

Splunk 3 rules