CmdID / Techniques / T1505

T1505.003 Server Software Component: Web Shell

Adversaries may backdoor web servers with web shells to establish persistent access to systems. MITRE ATT&CK

1 program on CmdID 11 Sigma rules T1505.003 on attack.mitre.org

Part of

MITRE ATT&CK

T1505Server Software Component

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

catits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highChopper Webshell Process PatternFlorian Roth (Nextron Systems), MSTI (query) · Windows

highCommvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

highLinux Webshell IndicatorsFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Linux

highSuspicious Child Process Of SQL ServerFPT.EagleEye Team, wagga · Windows

highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious Process Spawned by CentreStack Portal AppPoolJason Rathbun (Blackpoint Cyber) · Windows

highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson · Windows

highWebshell Hacking Activity PatternsFlorian Roth (Nextron Systems) · Windows

highWebshell Tool Reconnaissance ActivityCian Heasley, Florian Roth (Nextron Systems) · Windows

mediumExecution From Webserver Root FolderFlorian Roth (Nextron Systems) · Windows

mediumIIS Native-Code Module Command Line InstallationFlorian Roth (Nextron Systems) · Windows