[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1505-003":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1505-003","T1505.003","Web Shell",18,"MITRE","**What attackers do.** Attackers plant a web shell, a small script on a web server that accepts commands over HTTP, giving them persistent remote control of the server. It typically follows exploitation of a public-facing application and serves the Persistence tactic.\n\n**How to defend.** Patch internet-facing applications, restrict write access to web directories and run web services with minimal privileges. Use file integrity monitoring on web roots and deploy endpoint detection on web servers. Web application firewalls can block known web shell traffic.\n\n**Signs to look for.** Look for new or modified script files in web directories, web server processes spawning command shells, unusual requests to rarely used pages and POST requests to static content locations. A common gap is web servers without endpoint agents or file integrity monitoring.","Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.\n\nIn addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1505\u002F003\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"chinese-apt-exploits-beyondtrust-zero-day-to-harvest-credentials-and-exfiltrate-data","Chinese APT Exploits BeyondTrust Zero-Day to Harvest Credentials and Exfiltrate Data","2026-10-16T12:20:53.961+00:00",{"slug":25,"title":26,"published_at":27},"ahsaycbs-vulnerabilities-exploited-to-deploy-disguised-crypto-miners","AhsayCBS Vulnerabilities Exploited to Deploy Disguised Crypto Miners","2026-10-09T16:21:54.955+00:00",{"slug":29,"title":30,"published_at":31},"hafnium-exchange-attacks-highlight-critical-patching-failures","Hafnium Exchange Attacks Highlight Critical Patching Failures","2026-10-08T14:21:11.97+00:00",{"slug":33,"title":34,"published_at":35},"zero-day-strikes-citrix-netscaler-appliances-days-after-prior-patches","Zero-Day Strikes Citrix NetScaler Appliances Days After Prior Patches","2026-10-05T06:20:22.634+00:00",{"slug":37,"title":38,"published_at":39},"zimbra-zero-day-exploited-before-public-disclosure-patch-window-is-not-a-safe-window","Zimbra Zero-Day Exploited Before Public Disclosure — Patch Window Is Not a Safe Window","2026-10-01T14:21:08.736+00:00",{"slug":41,"title":42,"published_at":43},"citrix-netscaler-exploited-web-shells-hidden-in-css-like-urls-superusers-created","Citrix NetScaler Exploited: Web Shells Hidden in CSS-Like URLs, Superusers Created","2026-10-01T06:20:52.614+00:00",{"slug":45,"title":46,"published_at":47},"netscaler-zero-day-exploited-for-weeks-before-detection","NetScaler Zero-Day Exploited for Weeks Before Detection","2026-09-30T14:20:54.853+00:00",{"slug":49,"title":50,"published_at":51},"citrix-netscaler-zero-days-exploited-to-deploy-web-shells","Citrix NetScaler Zero-Days Exploited to Deploy Web Shells","2026-09-29T20:20:57.801+00:00",{"slug":53,"title":54,"published_at":55},"shinyhunters-exploits-unpatched-oracle-peoplesoft-to-breach-100-organizations","ShinyHunters Exploits Unpatched Oracle PeopleSoft to Breach 100+ Organizations","2026-09-28T19:22:43.303+00:00",{"slug":57,"title":58,"published_at":59},"famoussparrow-apt-uses-stealthy-backdoor-to-target-us-political-interests-in-latin-america","FamousSparrow APT Uses Stealthy Backdoor to Target US Political Interests in Latin America","2026-09-17T20:20:21.882+00:00",{"slug":61,"title":62,"published_at":63},"f5-big-ip-memory-injected-web-shell-evades-disk-based-detection","F5 BIG-IP Memory-Injected Web Shell Evades Disk-Based Detection","2026-09-09T10:21:59.938+00:00",{"slug":65,"title":66,"published_at":67},"clop-linked-web-shell-exploits-windchill-plm-to-steal-engineering-credentials","Clop-Linked Web Shell Exploits Windchill PLM to Steal Engineering Credentials","2026-08-19T10:22:04.784+00:00",[69,74,79,84,89,93],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",14,{"slug":75,"name":76,"problem":77,"stories":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",13,{"slug":80,"name":81,"problem":82,"stories":83},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",12,{"slug":85,"name":86,"problem":87,"stories":88},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",2,{"slug":90,"name":91,"problem":92,"stories":88},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":94,"name":95,"problem":96,"stories":97},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,[99,105,109,114,118,123,127,132],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","7","Control 7","Continuous Vulnerability Management",17,{"family":100,"item":106,"code":107,"title":108,"together":104},"13","Control 13","Network Monitoring and Defense",{"family":110,"item":111,"code":112,"title":113,"together":73},"nist-800-53","si-2","SI-2","Flaw Remediation",{"family":100,"item":115,"code":116,"title":117,"together":73},"12","Control 12","Network Infrastructure Management",{"family":119,"item":120,"code":121,"title":122,"together":78},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",{"family":110,"item":124,"code":125,"title":126,"together":83},"sc-7","SC-7","Boundary Protection",{"family":128,"item":129,"code":130,"title":130,"together":131},"itil","overview","ITIL",10,{"family":110,"item":133,"code":134,"title":135,"together":131},"ir-4","IR-4","Incident Handling"]