T1505.003sub-technique of T1505 Server Software Component
Web Shell
Linux · macOS · Network Devices · Windows4 pieces on this siteT1505.003 on attack.mitre.org
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Web shell on a public-facing server
An unfamiliar file in a web root, a web server process spawning a shell, or outbound traffic from a machine that should only ever receive it.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
YARA triage samples: five heuristic rules for a web root, a script directory or a triage collection
Request-fed web shells in PHP and ASP.NET, PowerShell that decodes, executes and reaches the network in one file, ransom notes, and LSASS minidumps left on disk. Hunting rules that produce files to open, not verdicts.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
A file transfer appliance wrote a file to itself
Say what happened, in what order, and what you need to establish before anybody says the word "contained".
Read
Analyses, case studies, guides, references and interview questions.
Case study: one appliance, and the disclosure that followed
CL0P against MOVEit Transfer, worked as a case rather than read as news. A zero-day in an internet-facing file transfer product, a web shell, and a scope question that has nothing to do with how many hosts were touched. Nine questions, and the answers are in the advisory.
how MITRE says to see it
Web Shell Detection via Server Behavior and File Execution Chains
- Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)
- File creation of unauthorized script (e.g.,.php,.sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx
- Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www
what reduces it
- M1018 User Account Management. Enforce the principle of least privilege by limiting privileges of user accounts so only authorized accounts can modify the web directory.
- M1042 Disable or Remove Feature or Program. Consider disabling functions from web technologies such as PHP’s `evaI()` that may be abused for web shells.