MITRE ATT&CKsub-technique

T1505.003 Web Shell

Published 2019-12-13 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Persistence
Platforms
Linux, macOS, Network Devices, Windows
Version
1.5
Created
2019-12-13

Description

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1505 Server Software Component technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1042 Disable or Remove Feature or Program mitigation
  • M1018 User Account Management mitigation

Referenced by MITRE ATT&CK · uses (67)

  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • C0061 Operation Digital Eye campaign
  • S9028 PHPsert software (malware)
  • S9024 SPAWNCHIMERA software (malware)
  • S9014 PHASEJAM software (malware)
  • C0058 SharePoint ToolShell Exploitation campaign
  • G1051 Medusa Group group
  • C0049 Leviathan Australian Intrusions campaign
  • S1187 reGeorg software (malware)
  • S1188 Line Runner software (malware)
  • S1189 Neo-reGeorg software (malware)
  • G1043 BlackByte group
  • C0041 FrostyGoop Incident campaign
  • G1041 Sea Turtle group
  • S1163 SnappyTCP software (malware)
  • C0040 APT41 DUST campaign
  • C0039 Versa Director Zero Day Exploitation campaign
  • C0038 HomeLand Justice campaign
  • G1030 Agrius group
  • C0032 C0032 campaign
  • C0034 2022 Ukraine Electric Power Attack campaign
  • S1120 FRAMESTING software (malware)
  • S1118 BUSHWALK software (malware)
  • S1119 LIGHTWIRE software (malware)
  • S1117 GLASSTOKEN software (malware)
  • S1115 WIREFIRE software (malware)
  • C0029 Cutting Edge campaign
  • S1113 RAPIDPULSE software (malware)
  • S1110 SLIGHTPULSE software (malware)
  • S1112 STEADYPULSE software (malware)
Show all 67 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-650 Upload a Web Shell to a Web Server attack pattern

Referenced by Compliance · mitigates (10)

  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References