Web Shell
Parent: T1505
Description
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW) In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013)
Mapped SPARTA techniques
No techniques mapped to this control.
Cross-framework references
Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.
Countered by 31 in MITRE D3FEND (Defensive Techniques)
- D3-ABPIApplication-based Process Isolation
- D3-CFContent Filtering
- D3-CMContent Modification
- D3-CQContent Quarantine
- D3-DADynamic Analysis
- D3-DFDecoy File
- D3-EALExecutable Allowlisting
- D3-EDLExecutable Denylisting
- D3-EFAEmulated File Analysis
- D3-EHBEndpoint Health Beacon
- D3-FAFile Analysis
- D3-FEFile Encryption
- D3-FEVFile Eviction
- D3-FIMFile Integrity Monitoring
- D3-HBPIHardware-based Process Isolation
- D3-HRHost Reboot
- D3-HSHost Shutdown
- D3-KBPIKernel-based Process Isolation
- D3-LFPLocal File Permissions
- D3-LLMLogical Link Mapping
- D3-NNINetwork Node Inventory
- D3-PLAProcess Lineage Analysis
- D3-PLMPhysical Link Mapping
- D3-PSProcess Suspension
- D3-PSAProcess Spawn Analysis
- D3-PSMDProcess Self-Modification Detection
- D3-PTProcess Termination
- D3-RFRestore File
- D3-RFAMRemote File Access Mediation
- D3-RNARestore Network Access
- D3-SCFSystem Call Filtering
Cite as SafeMode Space, mitre-attack-enterprise T1505.003.