A web shell turns an internet-facing server or appliance into a persistent, authenticated-looking entry point that needs no outbound beacon and leaves little on disk. MITRE ATT&CK Enterprise v20 catalogues 23 software entries that NHI Mgmt Group groups as web shells, from the decade-old China Chopper to the Perl and Python shells planted inside Ivanti Connect Secure files in 2024. This hub lists every one of them with its ATT&CK ID, platforms, associated groups and distinctive techniques, then draws out the behaviours they share so detection can be built once for the whole category. It is for detection engineers, threat hunters and the teams that own web servers, Exchange and SharePoint, VPN gateways and other edge appliances. For hands-on hunting on PHP servers and a ready-made incident template, follow the links to the deep guides rather than reading the same steps twice here.
Key takeaways
- The category has moved to the edge. Of the 23 entries, 14 list Network Devices as a platform in ATT&CK v20, against 10 that list Windows; recent additions are mostly shells inside VPN, SD-WAN and firewall software.
- One technique defines the group. 20 of the 23 entries map to T1505.003 Web Shell, and 16 use T1071.001 Web Protocols, so the request path into the server is the common detection surface.
- Shells hide inside legitimate files. Several members are code inserted into a vendor's own script (BUSHWALK in querymanifest.cgi, FRAMESTING in category.py, STEADYPULSE in a Pulse Secure Perl script), which defeats "look for new files" hunting on its own.
- Process lineage is the strongest signal on servers. NSA and ASD, and Microsoft, all point to the web server process (w3wp.exe, the Apache user) launching shells and reconnaissance commands such as whoami and net as the most reliable indicator.
- Treat the host's secrets as stolen. Shells such as OwaAuth, VersaMem and the Ivanti family capture credentials or keys, so eradication without rotating credentials, API keys and machine keys leaves the attacker a way back.
What counts as a web shell in ATT&CK
ATT&CK models a web shell as a script or module placed on an accessible web server that lets an adversary use the server as a gateway into the network, recorded under T1505 Server Software Component as sub-technique T1505.003 Web Shell. The software entries in this hub are specific, named implementations. NHI Mgmt Group assigns each ATT&CK software entry to one hub; the assignment is ours, not MITRE's, and three entries here (BlackMould, Caterpillar WebShell and VersaMem) are described by ATT&CK as web shells although v20 records no T1505.003 relationship for them.
| Sub-group | Members | Where it lives |
|---|---|---|
| Classic Windows server shells | China Chopper, ASPXSpy, BlackMould, OwaAuth, SEASHARPEE, Caterpillar WebShell, SUPERNOVA | IIS, Exchange (OWA) and .NET application servers |
| Public multi-platform shells and tunnels | P.A.S. Webshell, reGeorg, Neo-reGeorg, PHPsert, SnappyTCP | PHP, Python and generic Linux or Unix web servers, often reused across groups |
| Pulse Secure and Ivanti appliance shells | PULSECHECK, SLIGHTPULSE, STEADYPULSE, RAPIDPULSE, WIREFIRE, GLASSTOKEN, BUSHWALK, LIGHTWIRE, FRAMESTING | Perl CGI and Python components inside the appliance web interface |
| Other edge platform shells | VersaMem, Line Runner | Versa Director (Java, in memory) and Cisco ASA (Lua scripts) |
Grouping into sub-groups is an NHI Mgmt Group reading of the ATT&CK descriptions. For implants on the same appliances that are not web shells (backdoors, credential stealers, loaders), see the ATT&CK Network Device Malware Software Hub.
Shared behaviours across the 23 entries
The counts below are computed from the current "uses" relationships between these 23 software entries and techniques in ATT&CK Enterprise v20 (revoked and deprecated objects excluded). They show what a detection programme for the whole category needs to see.
| Technique | Entries using it | What it means for defenders |
|---|---|---|
| T1505.003 Web Shell | 20 | Unexpected or modified server-side script files; file integrity on web roots and appliance code is the core control |
| T1071.001 Web Protocols | 16 | Commands arrive inside ordinary HTTP(S) requests, so request logs and decrypted traffic matter more than outbound C2 hunting. See MITRE ATT&CK T1071 Application Layer Protocol. |
| T1105 Ingress Tool Transfer | 12 | The shell is a staging point: watch for the web server process writing new executables or archives. See T1105 Ingress Tool Transfer Defensive Guide. |
| T1140 Deobfuscate/Decode Files or Information | 10 | Base64, RC4 and XOR encoded parameters and payloads, decoded only at run time |
| T1005 Data from Local System | 6 | Reading configuration files, keys and credentials stored on the server |
| T1132.001 Standard Encoding | 6 | Encoded request and response bodies that look like random strings in logs |
| T1083 File and Directory Discovery | 5 | Directory browsing functions built into the shell |
| T1554 Compromise Host Software Binary | 4 | Code inserted into legitimate vendor files on appliances, invisible to "new file" checks |
| T1059.003 Windows Command Shell | 4 | cmd.exe as a child of the web server process |
| T1070.006 Timestomp and T1070.004 File Deletion | 3 each | File times are unreliable evidence; NSA and ASD warn against trusting timestamps |
The pattern is consistent: initial access through an exposed application (usually T1190 Exploit Public-Facing Application), a script that accepts encoded commands over the normal web port, then staging and reconnaissance from the server's own process. Tunnelling shells (reGeorg and Neo-reGeorg) add T1572 Protocol Tunnelling to reach internal hosts through the server.
Complete catalogue: all 23 web shells in ATT&CK v20
Every entry assigned to this hub, in ATT&CK ID order. "Associated groups and campaigns" shows up to three current group or campaign relationships from v20 (G and C IDs), linking a live NHI Mgmt Group actor profile where one exists. "Techniques" is the number of current technique relationships, and "Distinctive techniques" lists the entry's least common techniques within this category, which are the most useful for telling members apart.
| ID | Name | Type | Platforms | Associated groups and campaigns | Techniques | Distinctive techniques |
|---|---|---|---|---|---|---|
| S0020 | China Chopper | Malware | Windows | Threat Group-3390 (G0027), Leviathan (G0065), GALLIUM (G0093), +6 more | 10 | T1027.002 Software Packing; T1110.001 Password Guessing; T1046 Network Service Discovery |
| S0072 | OwaAuth | Malware | Windows | No group relationship in v20 | 8 | T1056.001 Keylogging; T1505.004 IIS Components; T1560.003 Archive via Custom Method |
| S0073 | ASPXSpy | Malware | Windows | Night Dragon (C0002), Threat Group-3390 (G0027), APT39 (G0087), +3 more | 1 | T1505.003 Web Shell |
| S0185 | SEASHARPEE | Malware | Windows | OilRig (G0049) | 4 | T1070.006 Timestomp; T1059.003 Windows Command Shell; T1105 Ingress Tool Transfer |
| S0564 | BlackMould | Malware | Windows | GALLIUM (G0093) | 6 | T1680 Local Storage Discovery; T1059.003 Windows Command Shell; T1083 File and Directory Discovery |
| S0572 | Caterpillar WebShell | Malware | Windows | Volatile Cedar (G0123) | 15 | T1007 System Service Discovery; T1014 Rootkit; T1016 System Network Configuration Discovery |
| S0578 | SUPERNOVA | Malware | Windows | No group relationship in v20 | 5 | T1036.005 Match Legitimate Resource Name or Location; T1203 Exploitation for Client Execution; T1027.013 Encrypted/Encoded File |
| S0598 | P.A.S. Webshell | Malware | Linux, Windows | Sandworm Team (G0034), Ember Bear (G1003) | 15 | T1087.001 Local Account; T1213.006 Databases; T1222.002 Linux and Mac Permissions |
| S1108 | PULSECHECK | Malware | Network Devices, Linux | APT5 (G1023) | 4 | T1059.004 Unix Shell; T1132.001 Standard Encoding; T1071.001 Web Protocols |
| S1110 | SLIGHTPULSE | Malware | Network Devices, Linux | APT5 (G1023) | 9 | T1074.001 Local Data Staging; T1059 Command and Scripting Interpreter; T1573.001 Symmetric Cryptography |
| S1112 | STEADYPULSE | Malware | Network Devices | No group relationship in v20 | 5 | T1132.001 Standard Encoding; T1140 Deobfuscate/Decode Files or Information; T1105 Ingress Tool Transfer |
| S1113 | RAPIDPULSE | Malware | Network Devices, Linux | APT5 (G1023) | 4 | T1027.013 Encrypted/Encoded File; T1005 Data from Local System; T1140 Deobfuscate/Decode Files or Information |
| S1115 | WIREFIRE | Malware | Network Devices | Cutting Edge (C0029) | 7 | T1573.001 Symmetric Cryptography; T1554 Compromise Host Software Binary; T1132.001 Standard Encoding |
| S1117 | GLASSTOKEN | Malware | Network Devices | Cutting Edge (C0029) | 4 | T1059.001 PowerShell; T1132.001 Standard Encoding; T1140 Deobfuscate/Decode Files or Information |
| S1118 | BUSHWALK | Malware | Network Devices | Cutting Edge (C0029) | 6 | T1205 Traffic Signaling; T1027 Obfuscated Files or Information; T1554 Compromise Host Software Binary |
| S1119 | LIGHTWIRE | Malware | Network Devices | Cutting Edge (C0029) | 5 | T1573.001 Symmetric Cryptography; T1554 Compromise Host Software Binary; T1140 Deobfuscate/Decode Files or Information |
| S1120 | FRAMESTING | Malware | Network Devices | Cutting Edge (C0029) | 7 | T1001 Data Obfuscation; T1001.003 Protocol or Service Impersonation; T1059.006 Python |
| S1154 | VersaMem | Malware | Network Devices | Versa Director Zero Day Exploitation (C0039), Volt Typhoon (G1017) | 8 | T1040 Network Sniffing; T1056.004 Credential API Hooking; T1129 Shared Modules |
| S1163 | SnappyTCP | Malware | Linux | Sea Turtle (G1041) | 5 | T1573.002 Asymmetric Cryptography; T1059.004 Unix Shell; T1095 Non-Application Layer Protocol |
| S1187 | reGeorg | Malware | Network Devices, Windows, macOS, Linux | APT28 (G0007), APT29 (G0016), Ember Bear (G1003) | 10 | T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares; T1021.004 SSH |
| S1188 | Line Runner | Malware | Network Devices | ArcaneDoor (C0046) | 8 | T1027.015 Compression; T1059.011 Lua; T1557 Adversary-in-the-Middle |
| S1189 | Neo-reGeorg | Malware | Network Devices, Windows, macOS, Linux | Sandworm Team (G0034) | 8 | T1132.002 Non-Standard Encoding; T1090 Proxy; T1572 Protocol Tunneling |
| S9028 | PHPsert | Malware | Network Devices | Operation Digital Eye (C0061) | 6 | T1027.013 Encrypted/Encoded File; T1132.001 Standard Encoding; T1140 Deobfuscate/Decode Files or Information |
China Chopper has nine group relationships in v20 (including HAFNIUM, APT41, Mustang Panda and Fox Kitten) and ASPXSpy has six, which is why both remain worth signatures years after first reporting. OwaAuth is described by ATT&CK as apparently exclusive to Threat Group-3390 although the relationship is recorded only in its description, and SUPERNOVA was found during the SolarWinds investigation but judged unrelated to it.
Real cases that shaped the category
Cutting Edge: Ivanti Connect Secure, December 2023 onward
Mandiant's investigation of exploitation of CVE-2023-46805 and CVE-2024-21887, which began as early as 3 December 2023, documented several of this hub's entries planted inside appliance components: BUSHWALK in the Perl file querymanifest.cgi, LIGHTWIRE in compcheckresult.cgi, FRAMESTING in the Python file category.py, with commands carried in a cookie named DSID (the same name Ivanti uses for VPN sessions), and WIREFIRE in visits.py. Mandiant assessed with moderate confidence that UNC5221 is a China-nexus espionage actor and recommended running the internal then the external Integrity Checker Tool, reviewing integrity event IDs SYS32039 to SYS32042 and SYS32087 to SYS32088, and searching for log event ADM20599, raised when logs are cleared. Attackers were seen tampering with the internal checker itself. The Ivanti Connect Secure exploitation breach page covers the credential consequences, and the Ivanti Connect Secure Hardening and Integrity Checking Guide covers the appliance controls. See also the UNC5221 (Ivanti exploitation) threat actor profile.
Earlier Pulse Secure intrusions
PULSECHECK, SLIGHTPULSE, RAPIDPULSE and STEADYPULSE were used from 2020 against Pulse Secure VPNs, including at US Defense Industrial Base companies, with ATT&CK linking three of them to APT5. The lesson repeated four years later on the same product line: appliance web components are writable by an attacker with code execution, and the vendor's integrity tooling is the primary check.
Server-side shells as key thieves
VersaMem, a Java archive deployed to Versa Director servers and linked by ATT&CK to Volt Typhoon, captured credentials for Versa Director logons. A shell outside this catalogue makes the same point: in the 2025 ToolShell SharePoint exploitation, the file spinstall0.aspx read the server's ASP.NET machine keys, which kept access alive after patching until the keys were rotated.
Detection themes for the whole category
Signatures catch reused public shells such as China Chopper and P.A.S. Webshell, but NSA and ASD note that host signatures are unreliable because shells are trivially modified. Build behavioural detection that works for any member.
| Signal | Telemetry | Example rule logic | Catches |
|---|---|---|---|
| Web server process spawns a shell or recon tool | Sysmon Event ID 1 or EDR process events; Linux auditd execve for the web server user | Parent w3wp.exe, httpd, nginx, php-fpm or java (Tomcat) with child cmd.exe, powershell.exe, sh, bash, whoami, net, ipconfig, ifconfig, netstat | Classic and public shells on Windows and Linux |
| New or changed script in a web root | File integrity monitoring; Sysmon Event ID 11 (FileCreate) | .aspx, .ashx, .jsp, .php, .cgi or .py written by the web server process, or any change outside a deployment window | Dropped shells, including inserted code in existing files |
| Rare URI access pattern | Web server and reverse proxy logs | A URI requested by very few client IPs or user agents, missing or odd Referer, POST to a static-looking page | Low-volume operator access |
| Appliance integrity mismatch | Vendor integrity tools and their event IDs; appliance syslog | Any mismatch, manifest error or tool failure treated as a potential compromise, not a fault | Pulse Secure, Ivanti and other appliance shells |
| Unexpected flows from the server | Firewall and NetFlow | DMZ web server opening connections to internal hosts or new ports | Tunnelling shells (reGeorg, Neo-reGeorg) and lateral movement |
| Log gaps | SIEM ingestion health; appliance log events | Drop in log volume from an exposed server, or a log clearing event | Cleanup after use (T1070.004) |
The Microsoft Defender team reported an average of 140,000 web shell encounters on servers per month between August 2020 and January 2021, almost double the previous year, and named w3wp.exe running net, whoami or dir as a strong early indicator. Exchange and SharePoint servers deserve their own rule set because their IIS application pools run management code legitimately, so baseline before alerting. For PHP specifics see PHP web shells; for a full detection strategy model see the ATT&CK Detection Strategies and Analytics Guide.
Hardening and response priorities
- Patch exposed applications first: NSA and ASD note that attackers often exploit newly published flaws within 24 hours, so internet-facing servers and appliances get the shortest patch window you run.
- Remove write access to code: the web application identity should not be able to write to web-accessible directories or change its own code; where that is impossible, alert on every change.
- Run vendor integrity checks on a schedule: for appliances, schedule the vendor's integrity tool, ship its results to the SIEM and treat a failed run as a finding.
- Segment the DMZ: a compromised web server should not reach domain controllers or internal management networks directly.
- Disable execution in upload folders: allow uploads only to directories with script execution turned off and scanning on.
- Respond as a credential incident: when a shell is found, follow the Web Shell Response Playbook, and plan rotation of everything the host could read.
Test rules in audit mode against a known-good build for two weeks before alerting, and keep a rollback path for any integrity enforcement that blocks deployments.
Where identity fits
A web shell runs as the server's own identity, so it inherits whatever that identity can reach: application pool accounts, database connection strings, API keys in configuration files, directory bind accounts on VPN appliances and machine keys. OwaAuth and VersaMem harvest user credentials directly; WARPWIRE, a credential stealer from the same Ivanti intrusions, is catalogued in the network device hub. After any confirmed shell, rotate local accounts, service account passwords, API keys and certificates held on the host, and reset users who authenticated while it was live. See the Rotating a Windows or Linux Service Account Password guide.
Detection and measurement
- Coverage: percentage of internet-facing servers and appliances with process lineage telemetry or a scheduled integrity check (target 100%).
- Web root integrity: unapproved file changes in web roots per month, and median time to triage each one.
- Patch latency: median days from vendor fix to deployment on exposed systems.
- Rule validation: number of the shared behaviours in the table above with a tested detection rule.
- Rotation completeness: share of secrets on a compromised host rotated within the incident window.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1505.003 Web Shell, T1505.004 IIS Components, T1190, T1554 | Placement, initial access and appliance code tampering |
| NIST SP 800-53 Rev. 5 | SI-7 Software, Firmware, and Information Integrity; SI-4 System Monitoring; SC-7 Boundary Protection; SI-2 Flaw Remediation | Integrity checks, monitoring, DMZ segmentation, patching |
| NIST CSF 2.0 | PR.PS-02 software maintained; DE.CM-09 computing hardware and software monitored | Patch and monitor exposed platforms |
| CIS Controls v8.1 | Control 7 Continuous Vulnerability Management; Control 13 Network Monitoring and Defense | Patching exposed services and watching their traffic |
Practitioner checklist
- List every internet-facing web server and appliance and the platform each runs.
- Alert on web server processes spawning shells and reconnaissance commands on Windows and Linux.
- Monitor file integrity on web roots and appliance code, including changes to existing files.
- Schedule vendor integrity tools on VPN and edge appliances and alert on any failure.
- Remove write access to web code from the application identity.
- Keep signatures for reused public shells (China Chopper, ASPXSpy, P.A.S. Webshell, reGeorg) current.
- Block DMZ web servers from opening connections to internal management networks.
- Pre-plan rotation of credentials, API keys, certificates and machine keys held on each exposed host.
Standards and references
- MITRE ATT&CK: T1505.003 Server Software Component: Web Shell
- MITRE ATT&CK: Software
- NSA and ASD: Detect and Prevent Web Shell Malware
- Mandiant: Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation
- Microsoft Security: Web shell attacks continue to rise
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- CIS: Critical Security Controls v8.1
Related NHI Mgmt Group resources: PHP web shells · Web Shell Response Playbook · ATT&CK Network Device Malware Software Hub · Edge Device Exploitation by Threat Actors Guide · MITRE ATT&CK Guide for Defenders