Webshells
في هذه الصفحة
Webshells answers: which web sites does the host serve, and do they hold a webshell - judged by where, when and how a script appeared, never by reading it.
At a glance
Question | Web servers and the sites they serve - and webshell indicators. |
Reads | IIS (with Exchange and SharePoint recognised), Apache httpd, nginx and Tomcat: their configuration, each site's folders, IIS's request log for flagged scripts. |
Never reads | The content of scripts. |
Rule prefix |
|
What it reads
Sites (
web_app): bindings, folders, the account the code runs as, what the site holds, and when it was last deployed.Scripts with indicators (
web_file): a server-side script written alone after the last deployment, in an upload or image folder, hidden, or with a disguised name; posted to in IIS's request log; or detected by the antivirus. Each gets a confidence: high, medium or low.IIS native modules and handlers (
web_module) that stand out - unsigned, or outside the usual folders.Shells a web server started: process rules over the web server's worker processes.
Signals it raises
6 rules: 4 high, 1 medium, 1 low. The full text of each is in the rule catalog.
ID | Severity | Title | Evidence | ATT&CK |
|---|---|---|---|---|
| high | A handler runs code for a static file type |
|
|
| high | IIS loads a native module from an unusual place, or one not validly signed |
|
|
| high | A web server process started a shell or a system tool |
|
|
| high | A server-side script carries strong webshell indicators |
|
|
| medium | A server-side script carries webshell indicators |
|
|
| low | A server-side script carries one webshell indicator |
|
|
How to read it
Deployment time is the baseline. A script written alone, days after the rest of the site was deployed, is the classic webshell pattern.
Requests: a flagged script that IIS's log shows receiving POSTs was used.
A shell started by
w3wp.exeis the strongest sign that a webshell ran a command.
What it can't see
Next
Applications: what software is installed.