Log in Request a demo

Attack technique

Server Software Component: Web Shell (T1505.003)

A web shell is a small script that an attacker places on a web server.

In short

A web shell is a small script that an attacker places on a web server. It lets the attacker run commands on that server from a distance. Because it sits on the server itself, it keeps working even if the first way in is closed, which is why attackers use it to keep access to the network over time.

Last updated 10 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Persistence · Step 5 Of 15 In The Attack Chain

  1. MITRE IDT1505.003ATT&CK technique
  2. Detection4ways to spot itNew scripts in web folders · Web server starting shells
  3. Defences3ways to stop itTurn off risky functions · Audit server components

How it works

Attackers put a web shell on a server that they can reach from the internet. The shell is a script that the web server runs like any other page.

The script gives the attacker a way to run commands or use a command line on the server. It is often paired with a client program that the attacker uses to talk to it.

Because the shell sits on the server itself, it keeps working even if the attacker’s first way in is closed. This is why MITRE files it under persistence, as one case of abusing server software components.

A real example

  • MITRE ATT&CK lists China Chopper as having a server component that is itself a web shell payload.
  • MITRE ATT&CK lists Agrius as typically deploying a variant of the ASPXSpy web shell after gaining initial access through exploitation.
  • MITRE ATT&CK lists APT28 as using a modified and obfuscated version of the reGeorg web shell to keep access to a target's webmail server.
  • MITRE ATT&CK lists APT5 as installing multiple web shells on compromised servers, including on VPN appliances.
  • MITRE ATT&CK lists BUSHWALK as a web shell that can run arbitrary commands or write files.

How to detect

  1. New scripts in web folders

    Watch for files created in web directories that nobody planned, especially scripts that are not part of normal site updates.

  2. Web server starting shells

    Look for the web server process starting command shells or unexpected system utilities soon after a new file appears.

  3. Log sources

    MITRE points to process execution, file creation events and web server activity logs as the data to review.

  4. Data sources MITRE lists

    File Creation, File Modification, Logon Session Creation, Network Traffic Content, Process Creation

How to defend

  1. Turn off risky functions

    Consider disabling functions in web technologies, such as PHP's eval(), that can be abused.

  2. Limit who can change web folders

    Apply least privilege so only authorized accounts can modify web directories.

  3. Audit server components

    MITRE's guidance for server software components also advises regular checks for unexpected changes and turning off unneeded server features.

Questions

What is a web shell?

A web shell is a script placed on a web server that the server runs like any other page. It gives the attacker a way to run commands or use a command line on the server.

Why do attackers use web shells?

The shell sits on the server itself, so it keeps working even if the attacker's first way in is closed. This is why MITRE files it under persistence.

How can I detect a web shell?

Watch for unplanned new scripts in web folders and for the web server process starting command shells or unexpected utilities. MITRE points to process execution, file creation events and web server logs.

How do I defend against web shells?

Limit who can change web folders using least privilege, and consider disabling risky functions such as PHP's eval(). Regularly check for unexpected changes and turn off unneeded server features.

In our research

  1. Two NetScaler Zero-Days, One Wrong Assumption: Why Patching Does Not Close the Incident October 2026
  2. No Patch Exists Yet: Who Owns the Pre-Disclosure Window? August 2026
  3. WP2Shell Technical Analysis: CVE-2026-63030 & CVE-2026-60137 WordPress Core RCE Chain July 2026
  4. Expired SSL Certificates: How a Lapsed Cert Becomes an Attack Vector July 2026
  5. Warlock Group: The Rise of GOLD SALEM (Storm-2603) in the Ransomware Landscape March 2026
  6. APT19 (DEEP PANDA): A Persistent China-Aligned Espionage and Credential Theft Actor March 2026

Sources

  1. MITRE ATT&CK T1505.003: Server Software Component: Web Shell MITRE
  2. MITRE ATT&CK T1505: Server Software Component MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Read more

Threat group

APT27 threat group profile

Attributed by MITRE ATT&CK and by the US Department of Justice (5 March 2025) to a Chinese group, also called Threat Group-3390 and Emissary Panda, that targets governments and companies. The Justice Department charged two men it calls APT27 actors, alleging profit-driven hacking from 2013 to 2024.

Read more