← All Chokepoints CRITICAL

Web Shell Persistence

Persistence Initial Access Execution T1505.003 T1190 T1059.004 Detection difficulty: MEDIUM Prevalence: HIGH

Adversaries plant web-accessible scripts (web shells) on compromised servers to maintain persistent command execution via HTTP/HTTPS. Web shells are deployed in virtually every major web-facing compromise — appearing in 35% of Q4 2024 IR incidents (Cisco Talos) and serving as the primary persistence mechanism in ProxyLogon, ProxyShell, MOVEit, Barracuda ESG, and Ivanti zero-day campaigns. Despite diversity in language (PHP/ASP.NET/JSP/Python), encoding (base64, XOR, gzinflate, multi-layer), and evasion technique (polyglot files, fileless IIS modules, steganography), the chokepoint is invariant: the web server process must execute attacker-controlled OS commands by spawning a child interpreter, and that parent-child relationship is always kernel-observable regardless of obfuscation. The ShellForge paper (arXiv 2601.22182) demonstrated that adversarially generated webshells achieve 93.9% evasion against VirusTotal commercial engines, validating that behavioral detection of process creation is essential over file-content scanning.

By @iimp0ster · Updated 2026-03-07 · View source YAML

Prerequisites (Environmental)

  • ✓ Write access to a web-accessible directory on the target server (via file upload, path traversal, CVE exploitation, or CMS compromise)
  • ✓ OR ability to modify web server configuration (for IIS native module approach)
  • ✓ Web server must execute the shell's scripting language (PHP, ASP.NET, JSP, etc.)
  • ✓ HTTP/HTTPS access to the deployed shell from attacker infrastructure
  • ✓ Server must have OS command execution capability (not hardened to deny shell spawning)

Variations

Tools and methods that exploit this chokepoint — the list grows; the chokepoint doesn't change:

China Chopper Active
2013
Godzilla Active
2020-Q4
Behinder (Ice Scorpion) Active
2020-Q1
AntSword Active
2019
Neo-reGeorg / reGeorg Active
2017
LEMURLOOT (MOVEit) Active
2023-Q2
Source →
GLASSTOKEN / BUSHWALK (Ivanti) Active
2024-Q1
Source →
SALTWATER / SEASPY (Barracuda ESG) Active
2023-Q2
Source →
Fileless IIS Native Modules Active
2022-Q1
Source →
Polyglot / Steganographic Shells Active
2020-Q1
Server-Side Template Injection (SSTI) Webshells Active
2019

Detection Strategy

Build detections iteratively. Start broad to understand your baseline, then tighten to production-ready.

Goal: Identify all child processes spawned by web server processes in the environment

Log Sources

  • Sysmon Event ID 1 (Process Creation)
  • Windows Security Event ID 4688 (Process Creation with CommandLine auditing enabled)
  • Linux auditd execve syscall events

FP Rate: High

Use Case: Baseline legitimate web server child process behavior; identify environments with routine shell spawning (misconfigured) vs. those with no child process spawning (well-hardened)

Detection Logic

Process Created (EID 1 or 4688):
  ParentImage: w3wp.exe OR httpd OR apache2 OR nginx OR java OR tomcat OR php-fpm
  ChildImage: ANY
Purpose: Build full baseline of all child processes spawned by web server processes; identify legitimate administration and deployment processes vs. anomalous execution
Sigma Rule — Research Level
View on GitHub Download 
title: Web Shell — All Child Processes Spawned by Web Server Processes (Research Baseline)
id: d4a6c8e0-3b5f-7a9c-1d2f-5h7i9j1k3m5n
status: experimental
description: >
  Maximum-visibility rule capturing every process creation event where the parent
  is a known web server worker process (IIS w3wp.exe, Apache httpd.exe, nginx,
  PHP-CGI, Tomcat, JBoss). Designed as a baselining rule to build a complete
  inventory of legitimate web server child processes before tuning toward
  behavioral hunt and analyst rules. Web shells are present in 35% of Q4 2024 IR
  incidents (Cisco Talos), and the ShellForge paper (arXiv 2601.22182) demonstrated
  that adversarially generated shells achieve 93.9% evasion against VirusTotal
  commercial engines — making behavioral process-creation detection essential over
  file-content scanning. The invariant that enables durable detection is:
  HTTP request → web server process → child OS interpreter. This rule captures
  every instance of that parent-child relationship, making it the foundation for
  identifying both the legitimate baseline and anomalous attacker-controlled execution.
  High false positive rate expected; purpose is environmental baselining only.
references:
  - https://attack.mitre.org/techniques/T1505/003/
  - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF
  - https://arxiv.org/abs/2601.22182
  - https://www.microsoft.com/en-us/security/blog/2021/02/11/web-shell-attacks-continue-to-rise/
  - https://blog.talosintelligence.com/talos-ir-trends-q4-2024/
author: "@iimp0ster"
date: 2026/03/08
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - detection.maturity.research
logsource:
  category: process_creation
  product: windows
detection:
  selection_web_server_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\apache.exe'
      - '\apache2.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\php.exe'
      - '\php-fpm.exe'
      - '\tomcat.exe'
      - '\tomcat9.exe'
      - '\tomcat10.exe'
      - '\java.exe'
      - '\javaw.exe'
  condition: selection_web_server_parent
falsepositives:
  - Legitimate CMS-triggered processes (WordPress image resize, Drupal cron via PHP)
  - Deployment pipeline scripts invoked via web-triggered hooks (CI/CD webhook handlers)
  - Scheduled tasks executed in the context of IIS application pools
  - wkhtmltopdf, ImageMagick, ghostscript spawned by PDF/image-generation web applications
  - Node.js, Python, Ruby child processes spawned by legitimate polyglot web applications
  - IIS application initialization scripts (warmup processes)
level: informational

Goal: Web server process spawning OS shell interpreters or reconnaissance utilities

Log Sources

  • Sysmon Event ID 1 (Process Creation)
  • Sysmon Event ID 11 (File Created)
  • Windows Security Event ID 4688 (Process Creation)
  • Linux auditd execve + open syscalls

FP Rate: Medium

Use Case: Proactive hunt for active webshell execution and new shell file drops; distinguishes attacker activity from legitimate server-side scripting

Detection Logic

Process Created (EID 1):
  ParentImage: w3wp.exe OR httpd OR apache2 OR nginx OR java OR php-fpm OR tomcat
  ChildImage:
    cmd.exe OR powershell.exe OR pwsh.exe OR wscript.exe OR cscript.exe OR
    /bin/sh OR /bin/bash OR /bin/dash OR python* OR perl OR ruby OR
    whoami.exe OR net.exe OR ipconfig.exe OR ifconfig OR id OR wget OR curl
OR:
  File Created (EID 11):
    Path: contains \inetpub\wwwroot\ OR /var/www/ OR /srv/www/ OR /usr/share/nginx/
    Extension: .php OR .asp OR .aspx OR .jsp OR .jspx OR .cfm OR .shtml
    CreatingProcess: NOT in approved deployment toolchain
Sigma Rule — Hunt Level
View on GitHub Download 
title: Web Shell — Web Server Spawning Shell Interpreter or Script File Dropped in Web Root
id: e5b7d9f1-4c6e-8a0b-2d3f-6i8j0k2l4n6o
status: experimental
description: >
  Detects two behavioral patterns associated with active web shell execution.
  Pattern A captures web server processes (IIS, Apache, nginx, PHP, Tomcat, Java)
  spawning OS shell interpreters (cmd.exe, powershell.exe, pwsh.exe) or common
  reconnaissance and download utilities — the execution step after a web shell
  receives an attacker HTTP command. Pattern B captures script file creation events
  (Sysmon EID 11) in web-accessible directories for server-side script extensions
  (.php, .asp, .aspx, .jsp) by processes outside an approved deployment toolchain —
  the initial shell file drop step. Together these cover both active shell execution
  (China Chopper, Godzilla, Behinder, AntSword) and new shell deployment. Fileless
  IIS native module webshells (Microsoft, 2022) still generate w3wp.exe child process
  events when commands execute, making Pattern A effective even against DLL-based shells.
  Medium false positive rate — requires baselining (see research rule) to identify
  what your web servers legitimately spawn before tuning.
references:
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1190/
  - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF
  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  - https://arxiv.org/abs/2601.22182
  - https://cloud.google.com/blog/topics/threat-intelligence/pst-want-shell-proxyshell-exploiting-microsoft-exchange-servers
author: "@iimp0ster"
date: 2026/03/08
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.003
  - attack.t1059.001
  - detection.maturity.hunt
logsource:
  category: process_creation
  product: windows
detection:
  # Pattern A: Web server process spawning known shell interpreters or recon utilities
  selection_spawn_web_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\apache.exe'
      - '\apache2.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\php.exe'
      - '\php-fpm.exe'
      - '\tomcat.exe'
      - '\tomcat9.exe'
      - '\tomcat10.exe'
      - '\java.exe'
      - '\javaw.exe'
  selection_spawn_child_shells:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
      - '\msiexec.exe'
      - '\wmic.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\ipconfig.exe'
      - '\systeminfo.exe'
      - '\netstat.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: (selection_spawn_web_parent and selection_spawn_child_shells)
falsepositives:
  - Legitimate CMS-triggered shell scripts via webhooks (Drupal, WordPress deployment)
  - Development environments where web server invokes build scripts
  - wkhtmltopdf or ImageMagick shell wrappers called by web applications
  - Java application servers invoking legitimate scripts via Runtime.exec()
  - Authorized administrative scripts triggered via web-based management interfaces
level: medium

Goal: Web server spawns shell interpreter with suspicious command AND web-accessible file recently created — direct webshell execution signal

Log Sources

  • Sysmon Event ID 1 (Process Creation)
  • Sysmon Event ID 3 (Network Connection)
  • Sysmon Event ID 11 (File Created)
  • Windows Security Event ID 4688 (Process Creation)
  • IIS/Apache/nginx access logs

FP Rate: Low

Use Case: SOC alerting; immediate IR escalation; highest confidence by correlating shell file creation with subsequent command execution

Detection Logic

File Created (EID 11) in web-accessible path:
  Extension: .php OR .asp OR .aspx OR .jsp OR .jspx
  CreatingProcess: NOT approved CMS or deployment tool
  Time: within last 24 hours
THEN within 60 minutes:
  Process Created (EID 1):
    ParentImage: w3wp.exe OR httpd OR apache2 OR java
    ChildImage: cmd.exe OR powershell.exe OR /bin/sh OR /bin/bash
    CommandLine: contains (whoami OR net user OR net group OR ipconfig OR
                           ifconfig OR id OR wget OR curl OR certutil)
OR (standalone — high confidence without file correlation):
  ParentImage: w3wp.exe AND ChildImage: powershell.exe AND
  CommandLine: contains (-enc OR -EncodedCommand OR IEX OR Invoke-Expression OR
                        DownloadString OR WebClient OR FromBase64String)
Sigma Rule — Analyst Level
View on GitHub Download 
title: Web Shell — High-Confidence Execution via Web Server Spawning Shell with Suspicious Command
id: f6c8e0a2-5d7f-9b1c-3e4g-7j9k1l3m5o7p
status: experimental
description: >
  High-fidelity detection for active web shell command execution. Detects a web
  server worker process (w3wp.exe, httpd.exe, apache2.exe, nginx.exe, java.exe,
  php-cgi.exe) spawning a shell interpreter (cmd.exe, powershell.exe) where the
  spawned process command line contains explicit attacker reconnaissance, exfiltration,
  or download indicators. This two-condition structure (web server parent AND
  suspicious child command line) provides strong specificity over the hunt rule's
  broader shell-spawn coverage. A second high-confidence selection covers PowerShell
  encoded command execution from a web server parent — a near-universal indicator
  of China Chopper, Godzilla, Behinder, and AntSword webshell variants, all of
  which use PowerShell encoded commands or IEX/WebClient patterns for payload delivery.
  The chokepoint invariant (HTTP request → web server process → child OS interpreter)
  holds regardless of shell language, encoding, or C2 encryption used; this rule
  detects the observable execution artifact at the endpoint layer. Low false positive
  rate; treat as immediate SOC escalation.
references:
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/001/
  - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF
  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  - https://arxiv.org/abs/2601.22182
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b
author: "@iimp0ster"
date: 2026/03/08
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - detection.maturity.analyst
logsource:
  category: process_creation
  product: windows
detection:
  # Shared filter: parent must be a web server process
  selection_web_server_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\apache.exe'
      - '\apache2.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\php.exe'
      - '\php-fpm.exe'
      - '\tomcat.exe'
      - '\tomcat9.exe'
      - '\tomcat10.exe'
      - '\java.exe'
      - '\javaw.exe'

  # Selection A: cmd.exe spawned by web server with recon/exfil/download command
  selection_cmd_recon:
    Image|endswith: '\cmd.exe'
    CommandLine|contains|any:
      - 'whoami'
      - 'net user'
      - 'net group'
      - 'net localgroup'
      - 'ipconfig'
      - 'systeminfo'
      - 'netstat'
      - 'tasklist'
      - 'quser'
      - 'qwinsta'
      - 'dir '
      - 'type '
      - 'copy '
      - 'move '
      - 'certutil'
      - 'bitsadmin'
      - 'mshta'
      - 'curl'
      - 'wget'
      - 'nltest'
      - 'arp '
      - 'ping '
      - 'nslookup'
      - 'reg query'
      - 'reg add'
      - 'schtasks'
      - 'at '
      - 'net use'
      - 'wmic'

  # Selection B: PowerShell with encoded command or downloader/execution pattern
  selection_powershell_encoded:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|any:
      - '-enc'
      - '-EncodedCommand'
      - '-e '
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'DownloadFile'
      - 'WebClient'
      - 'Net.WebClient'
      - 'FromBase64String'
      - 'ToBase64String'
      - 'BitsTransfer'
      - 'Start-BitsTransfer'
      - 'Invoke-WebRequest'
      - '-nop'
      - '-noprofile'
      - 'bypass'
      - 'hidden'
      - 'Add-MpPreference'
      - 'Set-MpPreference'
      - 'whoami'
      - 'net user'
      - 'net group'

  condition: selection_web_server_parent and (selection_cmd_recon or selection_powershell_encoded)
falsepositives:
  - Legitimate web applications that invoke system utilities as part of documented functionality (file conversion, health checks)
  - Authorized administrative web interfaces that invoke PowerShell for server management
  - Development environments where web applications execute scripts for testing
level: high

Early Detection Layers

Detect before the user pastes or executes — earlier in the kill chain than the Sysmon-based rules above, using different data sources.

OSINT Sources

Shodan http.title:"WSO" OR http.title:"b374k" OR http.title:"c99" OR http.title:"FilesMan" OR http.title:"Antak Webshell"

Finds internet-exposed web shells with default page titles intact — common in mass exploitation campaigns where attacker cadence outpaces cleanup. FilesMan and Antak are additional shells frequently left exposed. Also try http.html:"eval(base64_decode" to catch obfuscated PHP shells that render without a recognizable title.

 URLScan page.title:"WSO" OR filename:shell.php OR filename:webshell.php OR filename:cmd.aspx

Finds recently scanned pages presenting known webshell UI or common shell filenames; useful for tracking active campaign infrastructure and identifying newly deployed shells before cleanup. Add filenames specific to recent campaigns (e.g., human2.aspx for LEMURLOOT/MOVEit).

 VirusTotal Intelligence tag:webshell positives:0 type:text

Requires VT Intelligence subscription. Finds webshell samples currently evading all commercial AV detection — the most dangerous variants in active use. Consistent with ShellForge paper (arXiv 2601.22182) finding 93.9% evasion against commercial engines. Sort by submission date to prioritize the newest evasive variants.

 Censys services.http.response.body: "eval(base64_decode" and services.http.response.status_code: 200

Finds web servers returning HTTP 200 responses with the eval(base64_decode PHP obfuscation pattern — a near-universal indicator of a live obfuscated PHP shell. High precision; few legitimate pages contain this pattern. Requires Censys account.

Intel Resources

Related Chokepoints

Remote Execution Tools (HackTools) HIGH EDR Bypass Techniques CRITICAL