Wiki › Techniques, Tactics & Procedures (TTPs) › Persistence › Web Shell Persistence

Web Shell Persistence

3 min read

Jump to:

Overview

Web shell persistence is a technique where adversaries deploy malicious scripts on compromised web servers to maintain long-term access and control. This method enables attackers to execute commands, upload or download files, and pivot within the network while evading detection. It plays a critical role in sustaining footholds during the persistence and lateral movement phases of an attack lifecycle.

Attack Objective

Maintain persistent remote access and control over compromised systems
Supports Persistence, Execution, and Lateral Movement stages of the attack lifecycle
Allows attackers to bypass traditional authentication and maintain covert communication channels

How the Technique Works

Adversaries upload or inject web shell scripts—typically written in languages supported by the target web server such as PHP, ASP, or JSP—into accessible directories. These scripts act as backdoors, enabling remote command execution and file manipulation through standard web protocols. By embedding themselves within legitimate web applications or server directories, web shells blend with normal traffic, facilitating stealthy persistence.

Common Methods & Variations

Deployment via exploitation of web application vulnerabilities, misconfigurations, or compromised credentials
Variants include simple single-file shells, multi-stage loaders, or encrypted and obfuscated scripts
Applicable across on-premises and cloud-hosted web servers; variations exist depending on server technology and environment
Use of living-off-the-land techniques by leveraging native web server features and scripting languages versus custom-developed web shells

Indicators of Compromise (IOCs)

Unusual or unauthorized web shell files in web directories
Suspicious HTTP requests containing encoded commands or anomalous parameters
Unexpected outbound network connections originating from web servers
Logs showing execution of uncommon scripts or commands via web server processes
Changes in file timestamps or permissions inconsistent with normal operations

Detection Strategies

Monitoring web server logs for anomalous HTTP methods, parameters, or user agents
Behavioral analysis of web server processes for unusual command execution patterns
File integrity monitoring targeting web directories and configuration files
Correlation of network traffic anomalies with web server activity
Signature-based detection of known web shell code snippets or hashes

Mitigation & Prevention

Regular patching of web applications and underlying server software to remediate vulnerabilities
Strict access controls and least privilege principles for web server file systems and administrative interfaces
Implementation of web application firewalls (WAFs) to filter malicious requests
Use of secure coding practices to prevent injection vulnerabilities
Continuous monitoring and auditing of web server environments

Response Considerations

Immediate isolation of affected web servers to prevent further attacker activity
Comprehensive forensic analysis to identify web shell variants, deployment methods, and scope of compromise
Removal of web shells and restoration of clean server states from trusted backups
Review and hardening of web server configurations and access controls to prevent re-infection
Post-incident monitoring to detect potential persistence or lateral movement attempts

Related Techniques

Initial Access via Exploitation of Public-Facing Applications
Credential Access through Credential Dumping or Brute Force
Lateral Movement using Remote Services or Pass-the-Hash
Command and Control via Web Protocols
Defense Evasion through Obfuscated Files or Information

Mapping & References

MITRE ATT&CK Tactic: Persistence (TA0003), Execution (TA0002), Defense Evasion (TA0005)
MITRE ATT&CK Technique: Web Shell (T1505.003)
Public research and advisories from cybersecurity organizations on web shell detection and mitigation
Incident reports detailing web shell usage in advanced persistent threat campaigns

Tags: Command and Control Cybersecurity Defense Evasion Execution Incident Response Initial Access lateral movement persistence Threat Detection web shell