T1505.003 — Web Shell

Tactic: Persistence · Platforms: Linux, macOS, Network Devices, Windows

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to…

Sub-technique of Server Software Component (T1505).

Sigma detection rules (3)

title: "T1505.003 Server Software Component: Web Shell"
id: dc00c9c5-1a2b-4951-8b02-a560e931a414
description: 'Detects creation of script files with web-executable extensions (.aspx/.asp/.php/.jsp) within common web-root directories, written by a web-server worker process or a command interpreter, consistent with web shell deployment per T1505.003. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: WebRootPath, CreatorImage.'
references:
  - https://attack.mitre.org/techniques/T1505/003
author: Shahrukh Khan
date: 2026-02-28
license: MIT
tags:
  - attack.persistence
  - attack.t1505.003

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\htdocs\'
      - '\wwwroot\'
    TargetFilename|endswith:
      - '.aspx'
      - '.asp'
      - '.php'
      - '.jsp'
  selection_writer:
    Image|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\cmd.exe'
      - '\powershell.exe'
  condition: selection and selection_writer

falsepositives:
  - Legitimate application deployments or CI/CD pipelines writing new web scripts directly into the web root.

level: medium

title: "T1505.003 Server Software Component: Web Shell"
id: f0b76fea-6e21-4828-bbc9-173457e0a502
description: 'Web Shell Detection via Server Behavior and File Execution Chains: new PHP/JSP file creation under /var/www/, excluding files created by recognized deployment/package-manager tooling (apt, yum, dpkg, rpm, composer, git, rsync, ansible) so routine plugin/application deployments are filtered out while unattributed drops still alert. (Retargeted to the file_event auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WebRootPath, PayloadEntropyThreshold, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1505/003
author: Shahrukh Khan
date: 2026-02-07
license: MIT
tags:
  - attack.persistence
  - attack.t1505.003

logsource:
  category: file_event
  product: linux

detection:
  selection:
    type: PATH
    nametype: CREATE
    name|contains: '/var/www/'
    name|endswith:
      - '.php'
      - '.jsp'
  filter_deploy_tooling:
    exe|endswith:
      - '/apt'
      - '/apt-get'
      - '/dpkg'
      - '/yum'
      - '/rpm'
      - '/composer'
      - '/git'
      - '/rsync'
      - '/ansible-playbook'

  condition: selection and not filter_deploy_tooling

falsepositives:
  - Same webshell-drop pattern as the other T1505.003 rule, focused on file creation specifically; deployments performed by tooling not covered by filter_deploy_tooling (custom CI/CD agents, manual scp/sftp uploads) still alert, so PayloadEntropyThreshold/TimeWindow scoping to off-hours or unexpected authors remains recommended.

level: high

title: "T1505.003 Server Software Component: Web Shell"
id: f32ac469-ce11-453f-9830-f5a67d72ee70
description: 'Web Shell Detection via Server Behavior and File Execution Chains. Changed nametype from NORMAL to CREATE so this catches the classic new-file web shell drop instead of primarily flagging writes to already-existing PHP/JSP files. Paired with a companion shell-execution rule and a temporal_ordered correlation (grouped by pid) requiring the same process that dropped the file to subsequently execve a shell/interpreter, to cut CI/CD and legitimate-deploy false positives that pure path/extension matching cannot. (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: InterpreterName, ExecutionParent.'
references:
  - https://attack.mitre.org/techniques/T1505/003
author: Shahrukh Khan
date: 2026-06-16
license: MIT
tags:
  - attack.persistence
  - attack.t1505.003

logsource:
  category: file_change
  product: linux
  service: auditd

detection:
  selection:
    type: PATH
    nametype: CREATE
    name|contains: '/var/www/'
    name|endswith:
      - '.php'
      - '.jsp'

  condition: selection

falsepositives:
  - Legitimate web application deployment by CI/CD pipelines creating new PHP/JSP files; this rule alone cannot distinguish a benign deploy from a web shell drop. Pair with the companion execution rule and the correlation below, which requires the same process to also spawn a shell/interpreter, to cut deploy-pipeline noise.

level: medium
---
title: "T1505.003 Server Software Component: Web Shell - Shell Spawned by File-Writing Process"
id: c9d3e5f7-2a4b-4c6d-9e1f-8b3a6d5c2e91
description: 'Companion detection for f32ac469-ce11-453f-9830-f5a67d72ee70: captures a shell/scripting interpreter (sh, bash, dash, python, perl) being execve''d, used as the second leg of the temporal_ordered correlation below to identify the same process (pid) that just wrote a new PHP/JSP file under /var/www/ subsequently spawning a shell - the classic post-drop web shell interaction pattern, as distinct from a CI/CD deploy process that writes files and exits.'
references:
  - https://attack.mitre.org/techniques/T1505/003
author: Shahrukh Khan
date: 2026-06-16
license: MIT
tags:
  - attack.persistence
  - attack.t1505.003

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'

  condition: selection

falsepositives:
  - Any legitimate process that happens to share a pid with a web-server worker within the correlation window and independently spawns a shell/interpreter; pid reuse over longer windows can also produce coincidental matches.

level: medium
---
title: "T1505.003 Server Software Component: Web Shell - Confirmed Drop-then-Shell Chain"
id: d2f8a4c6-5e3b-4a7d-b1c9-3f6e8d2a5c74
description: 'Correlation companion linking f32ac469-ce11-453f-9830-f5a67d72ee70 (new PHP/JSP file creation under /var/www/) and c9d3e5f7-2a4b-4c6d-9e1f-8b3a6d5c2e91 (shell/interpreter execve): requires the same process (pid) that wrote the file to subsequently spawn a shell within a 5-minute window, approximating the actual web-shell interaction pattern and filtering out CI/CD deploy processes that write files and exit without ever spawning a shell. NOTE: grouping by pid assumes both events are attributable to the same auditd process id; if the interactive shell is spawned by a different worker process (e.g., load-balanced across php-fpm workers) this correlation will miss it.'
status: experimental
correlation:
  type: temporal_ordered
  rules:
    - f32ac469-ce11-453f-9830-f5a67d72ee70
    - c9d3e5f7-2a4b-4c6d-9e1f-8b3a6d5c2e91
  group-by:
    - pid
  timespan: 5m
  condition: "f32ac469-ce11-453f-9830-f5a67d72ee70 and c9d3e5f7-2a4b-4c6d-9e1f-8b3a6d5c2e91"
level: high

Related sub-techniques

• T1505.005 Terminal Services DLL
• T1505.001 SQL Stored Procedures
• T1505.006 vSphere Installation Bundles
• T1505.004 IIS Components
• T1505.002 Transport Agent

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1505.003 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan