Common Information
| Type | Value |
|---|---|
| Value |
Web Shell - T1100 |
| Category | Attack-Pattern |
| Type | Mitre-Enterprise-Attack-Attack-Pattern |
| Misp Type | Cluster |
| Description | A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (see, for example, China Chopper Web shell client). (Citation: Lee 2013) Web shells may serve as Redundant Access or as a persistence mechanism in case an adversary's primary access methods are detected and removed. Detection: Web shells can be difficult to detect. Unlike other forms of persistent remote access, they do not initiate connections. The portion of the Web shell that is on the server may be small and innocuous looking. The PHP version of the China Chopper Web shell, for example, is the following short payload: (Citation: Lee 2013) <code><?php @eval($_POST['password']);></code> Nevertheless, detection mechanisms exist. Process monitoring may be used to detect Web servers that perform suspicious actions such as running cmd or accessing files that are not in the Web directory. File monitoring may be used to detect changes to files in the Web directory of a Web server that do not match with updates to the Web server's content and may indicate implantation of a Web shell script. Log authentication attempts to the server and any unusual traffic patterns to or from the server and internal network. (Citation: US-CERT Alert TA15-314A Web Shells) Platforms: Linux, macOS, Windows Data Sources: Anti-virus, File monitoring, Process monitoring, Authentication logs, Netflow/Enclave netflow Effective Permissions: User, SYSTEM System Requirements: Adversary access to Web server with vulnerability or account to upload and serve the Web shell file. |
| Details | Published | Attributes | CTI | Title | ||
|---|---|---|---|---|---|---|
| Details | Website | 2024-10-02 | 0 | Critical Zimbra Vulnerability Exploited One Day After PoC Release | Antivirus and Security news | ||
| Details | Website | 2024-10-01 | 6 | CyberSecLabs — “Boats” Walkthrough | ||
| Details | Website | 2024-10-01 | 30 | Lock — Vulnlab Full Walkthrough | ||
| Details | Website | 2024-10-01 | 3 | Zimbra RCE Vuln Under Attack Needs Immediate Patching | ||
| Details | Website | 2024-09-30 | 6 | Threat Context Monthly: Executive intelligence briefing for September 2024 | ||
| Details | Website | 2024-09-28 | 33 | Active Directory Pentesting | Offensive Security Proving Grounds Access Writeup | ||
| Details | Website | 2024-09-28 | 41 | Trusted — Vulnlab Chain Full Walkthrough | ||
| Details | Website | 2024-09-27 | 123 | Betting on Bots: Investigating Linux malware, crypto mining, and gambling API abuse — Elastic Security Labs | ||
| Details | Website | 2024-09-26 | 6 | TWELVE Threat Attacks Windows To Encrypt Then Deleting Victims’ Data | ||
| Details | Website | 2024-09-25 | 0 | Are More Than Two-Thirds of Websites Vulnerable? - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. | ||
| Details | Website | 2024-09-25 | 8 | Zero Day Initiative — Exploiting Exchange PowerShell After ProxyNotShell: Part 4 – No Argument Constructor | ||
| Details | Website | 2024-09-24 | 0 | Cyber Briefing: 2024.09.24 | ||
| Details | Website | 2024-09-23 | 14 | Laravel Admin Exploit | HackTheBox Usage Writeup | ||
| Details | Website | 2024-09-22 | 0 | The Russian APT Tool Matrix | ||
| Details | Website | 2024-09-22 | 0 | The Russian APT Tool Matrix | ||
| Details | Website | 2024-09-22 | 4 | Hacktivist Group Twelve Targets Russian Entities with Destructive Cyber Attacks - RedPacket Security | ||
| Details | Website | 2024-09-22 | 6 | Iranian APT UNC1860 Linked to MOIS Facilitates Cyber Intrusions in Middle East - RedPacket Security | ||
| Details | Website | 2024-09-21 | 4 | Hacktivist Group Twelve Targets Russian Entities with Destructive Cyber Attacks | ||
| Details | Website | 2024-09-20 | 6 | Iranian APT UNC1860 Linked to MOIS Facilitates Cyber Intrusions in Middle East | ||
| Details | Website | 2024-09-20 | 143 | Twelve: from initial compromise to ransomware and wipers | ||
| Details | Website | 2024-09-19 | 7 | Shining a Light in the Dark – How Binary Defense Uncovered an APT Lurking in Shadows of IT | Binary Defense | ||
| Details | Website | 2024-09-19 | 47 | UNC1860 and the Temple of Oats: Iran’s Hidden Hand in Middle Eastern Networks | ||
| Details | Website | 2024-09-19 | 26 | UNC1860 and the Temple of Oats: Iran’s Hidden Hand in Middle Eastern Networks | Google Cloud Blog | ||
| Details | Website | 2024-09-17 | 1 | Infiltrating Defenses: Abusing VMware in MITRE’s Cyber Intrusion | ||
| Details | Website | 2024-09-17 | 4 | Cyberthreats in the Public Sector |