[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1505-003":3},{"item":4,"lessons":18,"controls":69,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1505-003","T1505.003","Web Shell",18,"MITRE","**What attackers do.** Attackers plant a web shell, a small script on a web server that accepts commands over HTTP, giving them persistent remote control of the server. It typically follows exploitation of a public-facing application and serves the Persistence tactic.\n\n**How to defend.** Patch internet-facing applications, restrict write access to web directories and run web services with minimal privileges. Use file integrity monitoring on web roots and deploy endpoint detection on web servers. Web application firewalls can block known web shell traffic.\n\n**Signs to look for.** Look for new or modified script files in web directories, web server processes spawning command shells, unusual requests to rarely used pages and POST requests to static content locations. A common gap is web servers without endpoint agents or file integrity monitoring.","Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.\n\nIn addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1505\u002F003\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},22,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"unpatched-check-point-gateways-wiped-after-chained-exploit-attack","Unpatched Check Point Gateways Wiped After Chained Exploit Attack","2026-11-13T13:22:53.744+00:00",{"slug":26,"title":27,"published_at":28},"unpatched-backup-servers-exploited-before-vendor-fixes-were-available","Unpatched Backup Servers Exploited Before Vendor Fixes Were Available","2026-11-11T11:20:58.243+00:00",{"slug":30,"title":31,"published_at":32},"turla-hijacked-exchange-servers-as-covert-c2-infrastructure","Turla Hijacked Exchange Servers as Covert C2 Infrastructure","2026-11-10T22:21:40.469+00:00",{"slug":34,"title":35,"published_at":36},"ahsaycbs-backup-server-compromise-patching-alone-is-not-enough-after-exploitation","AhsayCBS Backup Server Compromise: Patching Alone Is Not Enough After Exploitation","2026-11-09T15:22:23.638+00:00",{"slug":38,"title":39,"published_at":40},"chinese-apt-exploits-beyondtrust-zero-day-to-harvest-credentials-and-exfiltrate-data","Chinese APT Exploits BeyondTrust Zero-Day to Harvest Credentials and Exfiltrate Data","2026-10-16T12:20:53.961+00:00",{"slug":42,"title":43,"published_at":44},"ahsaycbs-vulnerabilities-exploited-to-deploy-disguised-crypto-miners","AhsayCBS Vulnerabilities Exploited to Deploy Disguised Crypto Miners","2026-10-09T16:21:54.955+00:00",{"slug":46,"title":47,"published_at":48},"hafnium-exchange-attacks-highlight-critical-patching-failures","Hafnium Exchange Attacks Highlight Critical Patching Failures","2026-10-08T14:21:11.97+00:00",{"slug":50,"title":51,"published_at":52},"zero-day-strikes-citrix-netscaler-appliances-days-after-prior-patches","Zero-Day Strikes Citrix NetScaler Appliances Days After Prior Patches","2026-10-05T06:20:22.634+00:00",{"slug":54,"title":55,"published_at":56},"zimbra-zero-day-exploited-before-public-disclosure-patch-window-is-not-a-safe-window","Zimbra Zero-Day Exploited Before Public Disclosure — Patch Window Is Not a Safe Window","2026-10-01T14:21:08.736+00:00",{"slug":58,"title":59,"published_at":60},"citrix-netscaler-exploited-web-shells-hidden-in-css-like-urls-superusers-created","Citrix NetScaler Exploited: Web Shells Hidden in CSS-Like URLs, Superusers Created","2026-10-01T06:20:52.614+00:00",{"slug":62,"title":63,"published_at":64},"netscaler-zero-day-exploited-for-weeks-before-detection","NetScaler Zero-Day Exploited for Weeks Before Detection","2026-09-30T14:20:54.853+00:00",{"slug":66,"title":67,"published_at":68},"citrix-netscaler-zero-days-exploited-to-deploy-web-shells","Citrix NetScaler Zero-Days Exploited to Deploy Web Shells","2026-09-29T20:20:57.801+00:00",[70,74,79,83,88,93],{"slug":71,"name":72,"problem":73,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":75,"name":76,"problem":77,"stories":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",15,{"slug":80,"name":81,"problem":82,"stories":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":84,"name":85,"problem":86,"stories":87},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",3,{"slug":89,"name":90,"problem":91,"stories":92},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",2,{"slug":94,"name":95,"problem":96,"stories":92},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[98,104,108,114,119,125,130,135],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","7","Control 7","Continuous Vulnerability Management",20,{"family":99,"item":105,"code":106,"title":107,"together":9},"13","Control 13","Network Monitoring and Defense",{"family":109,"item":110,"code":111,"title":112,"together":113},"nist-800-53","si-2","SI-2","Flaw Remediation",16,{"family":99,"item":115,"code":116,"title":117,"together":118},"12","Control 12","Network Infrastructure Management",14,{"family":120,"item":121,"code":122,"title":123,"together":124},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",13,{"family":109,"item":126,"code":127,"title":128,"together":129},"sc-7","SC-7","Boundary Protection",12,{"family":109,"item":131,"code":132,"title":133,"together":134},"ir-4","IR-4","Incident Handling",10,{"family":136,"item":137,"code":138,"title":138,"together":134},"itil","overview","ITIL"]