Detect Web Shell in Splunk
Adversaries install web shells on compromised web servers to maintain persistent access. A web shell is a script (PHP, ASP, ASPX, JSP, etc.) that provides command execution, file upload/download, and network proxying capabilities via HTTP. Web shells are used by dozens of threat groups including APT28, APT39, HAFNIUM, OilRig, GALLIUM, and Sandworm. China Chopper and P.A.S. Webshell are widely-used examples. IcedID, WIREFIRE, and BUSHWALK target specific appliances (Ivanti VPN).
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1505 Server Software Component
- Sub-technique
- T1505.003 Web Shell
- Canonical reference
- https://attack.mitre.org/techniques/T1505/003/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval detection_type=case(
EventCode=1 AND
match(ParentImage, "(?i)(w3wp|httpd|nginx|php|php-cgi|tomcat|catalina|java|javaw)\.exe") AND
match(Image, "(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|whoami|net|ipconfig|systeminfo|wmic|nltest|netstat|ping|nslookup)\.exe"),
"WebServer_Spawned_Shell",
EventCode=11 AND
match(TargetFilename, "(?i)(\\\\inetpub|\\\\wwwroot|\\\\htdocs|\\\\www|\\\\webapps)") AND
match(TargetFilename, "(?i)\\.(asp|aspx|ashx|asmx|php|jsp|jspx|cfm|shtml)$") AND
NOT match(Image, "(?i)(w3wp|httpd|nginx|php|deploy|publish)\.exe"),
"WebShell_File_Drop",
EventCode=3 AND
match(Image, "(?i)(w3wp|php|php-cgi|httpd)\.exe") AND
NOT match(DestinationIp, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)") AND
NOT (DestinationPort=80 OR DestinationPort=443 OR DestinationPort=8080 OR DestinationPort=8443),
"WebServer_External_Connection",
true(), null()
)
| where isnotnull(detection_type)
| eval risk_score=case(
detection_type="WebServer_Spawned_Shell", 10,
detection_type="WebShell_File_Drop", 8,
detection_type="WebServer_External_Connection", 7,
true(), 5
)
| table _time, host, User, detection_type, risk_score, Image, CommandLine, TargetFilename,
DestinationIp, DestinationPort, ParentImage
| sort - risk_score, - _timeDetects web shell activity via Sysmon with risk scoring. EventCode 1 web server spawning shells (score 10 — highest fidelity). EventCode 11 script file drops to web directories (score 8). EventCode 3 web server external connections on non-HTTP ports (score 7). Results sorted by risk score to prioritize highest-confidence alerts.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legacy web applications running under IIS that legitimately spawn cmd.exe for system integration
- Legitimate file upload functionality writing script files to web directories (requires tuning by file path and initiating process)
- CI/CD deployment pipelines writing application files including .php/.aspx to web roots
Other platforms for T1505.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simple ASPX Web Shell Drop (Test Environment Only)
Expected signal: Sysmon EventCode 11: FileCreate with TargetFilename=C:\inetpub\wwwroot\df00tech-test.aspx. When web request triggers the shell: Sysmon EventCode 1 with ParentImage=w3wp.exe and Image=cmd.exe.
- Test 2Simulate Web Shell Command Execution (w3wp Spawning cmd)
Expected signal: Sysmon EventCode 1: cmd.exe spawned by powershell.exe. In a real web shell scenario, ParentImage would be w3wp.exe.
- Test 3China Chopper Web Shell Pattern Check
Expected signal: Sysmon EventCode 11: FileCreate with TargetFilename=C:\inetpub\wwwroot\df00tech-cc-test.php and Image=powershell.exe.
References (6)
- https://attack.mitre.org/techniques/T1505/003/
- https://github.com/nsacyber/Mitigating-Web-Shells
- https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html
- https://www.us-cert.gov/ncas/alerts/TA15-314A
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1505.003/T1505.003.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Unlock Pro Content
Get the full detection package for T1505.003 including response playbook, investigation guide, and atomic red team tests.