Server Software Component: Web Shell T1505.003

Events covered

9 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 77 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (63 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (1229 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (290 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 31 rules

• Antivirus Web Shell Detection
• Chopper Webshell Process Pattern
• Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)
• CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit
• DEWMODE Webshell Access
• Execution From Webserver Root Folder
• IIS Native-Code Module Command Line Installation
• Linux Webshell Indicators
• MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request
• Oracle WebLogic Exploit
• Potential Java WebShell Upload in SAP NetViewer Server
• Potential SAP NetViewer Webshell Command Execution
• Potential Webshell Creation On Static Website
• Rejetto HTTP File Server RCE
• Shellshock Expression
• Solarwinds SUPERNOVA Webshell Access
• Suspicious ASPX File Drop by Exchange
• Suspicious Child Process Of SQL Server
• Suspicious File Drop by Exchange
• Suspicious File Write to SharePoint Layouts Directory
• Suspicious File Write to Webapps Root Directory
• Suspicious MSExchangeMailboxReplication ASPX Write
• Suspicious Process By Web Server Process
• Suspicious Process Spawned by CentreStack Portal AppPool
• Suspicious Windows Strings In URI
• Webshell Detection With Command Line Keywords
• Webshell Hacking Activity Patterns
• Webshell ReGeorg Detection Via Web Logs
• Webshell Remote Command Execution
• Webshell Tool Reconnaissance Activity
• Windows Webshell Strings

Elastic 22 rules

• Deprecated - Uncommon Destination Port Connection by Web Server
• Deprecated - Unusual Command Execution from Web Server Parent
• Deprecated - Unusual Process Spawned from Web Server Parent
• Initial Access via File Upload Followed by GET Request
• Microsoft Exchange Server UM Writing Suspicious Files
• Microsoft Exchange Worker Spawning Suspicious Processes
• Potential SAP NetWeaver Exploitation
• Potential SAP NetWeaver WebShell Creation
• Potential Web Shell ASPX File Creation
• Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation
• ScreenConnect Server Spawning Suspicious Processes
• Simple HTTP Web Server Connection
• Simple HTTP Web Server Creation
• Suspicious Child Execution via Web Server
• Suspicious Command Execution via Web Server
• Unusual Child Execution via Web Server
• Unusual Command Execution via Web Server
• Unusual File Creation by Web Server
• Web Server Exploitation Detected via Defend for Containers
• Web Server Potential Command Injection Request
• Web Shell Detection: Script Process Child of Common Web Processes
• Windows Server Update Service Spawning Suspicious Processes

Splunk 20 rules

• Cisco Configuration Archive Logging Analysis
• Cisco Secure Firewall - Privileged Command Execution via HTTP
• Detect Exchange Web Shell
• Exploit Public Facing Application via Apache Commons Text
• MS Exchange Mailbox Replication service writing Active Server Pages
• Shell Spawned by Web Server - Windows (Windows Event Log)
• Spring4Shell Payload URL Request
• Supernova Webshell
• Tomcat Session Deserialization Attempt
• Tomcat Session File Upload Attempt
• Web JSP Request via URL
• Windows Metasploit Confluence Plugin Execution
• Windows Potential Web Shell Creation For VMware Workspace ONE
• Windows SharePoint Spinstall0 GET Request
• Windows SharePoint Spinstall0 Webshell File Creation
• Windows SharePoint ToolPane Endpoint Exploitation Attempt
• Windows Suspicious Child Process Spawned From WebServer
• Windows TeamCity Payload Execution from Temp Directory
• Windows TeamCity Plugin Installed
• Windows WSUS Spawning Shell

YARA-L 4 rules

• Attempted SharePoint Webshell Creation CVE-2025-53770
• Potential Webshell Process Execution
• Successful SharePoint Webshell Creation CVE-2025-53770
• Suspicious Filewrites To Sharepoint Layouts