Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >ATTACK
  3. >Persistence
  4. >ATTACK-T1505.003
ATTACK-T1505.003Active

Web Shell

Statement

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW)

In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).(Citation: Lee 2013)

Location

Tactic
Persistence

Technique Details

Identifier
ATTACK-T1505.003
Parent Technique
ATTACK-T1505
ATT&CK Page
View on MITRE

Tactics

Persistence

Platforms

LinuxmacOSNetwork DevicesWindows

Detection

Web Shell Detection via Server Behavior and File Execution Chains

Mitigations

Disable or Remove Feature or Program: Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures:

Remove Legacy Software:

  • Use Case: Disable or remove older versions of software that no longer receive updates or security patches (e.g., legacy Java, Adobe Flash).
  • Implementation: A company removes Flash Player from all employee systems after it has reached its end-of-life date.

Disable Unused Features:

  • Use Case: Turn off unnecessary operating system features like SMBv1, Telnet, or RDP if they are not required.
  • Implementation: Disable SMBv1 in a Windows environment to mitigate vulnerabilities like EternalBlue.

Control Applications Installed by Users:

  • Use Case: Prevent users from installing unauthorized software via group policies or other management tools.
  • Implementation: Block user installations of unauthorized file-sharing applications (e.g., BitTorrent clients) in an enterprise environment.

Remove Unnecessary Services:

  • Use Case: Identify and disable unnecessary default services running on endpoints, servers, or network devices.
  • Implementation: Disable unused administrative shares (e.g., C$, ADMIN$) on workstations.

Restrict Add-ons and Plugins:

  • Use Case: Remove or disable browser plugins and add-ons that are not needed for business purposes.
  • Implementation: Disable Java and ActiveX plugins in web browsers to prevent drive-by attacks.

User Account Management: User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures:

Enforcing the Principle of Least Privilege

  • Implementation: Assign users only the minimum permissions required to perform their job functions. Regularly audit accounts to ensure no excess permissions are granted.
  • Use Case: Reduces the risk of privilege escalation by ensuring accounts cannot perform unauthorized actions.

Implementing Strong Password Policies

  • Implementation: Enforce password complexity requirements (e.g., length, character types). Require password expiration every 90 days and disallow password reuse.
  • Use Case: Prevents adversaries from gaining unauthorized access through password guessing or brute force attacks.

Managing Dormant and Orphaned Accounts

  • Implementation: Implement automated workflows to disable accounts after a set period of inactivity (e.g., 30 days). Remove orphaned accounts (e.g., accounts without an assigned owner) during regular account audits.
  • Use Case: Eliminates dormant accounts that could be exploited by attackers.

Account Lockout Policies

  • Implementation: Configure account lockout thresholds (e.g., lock accounts after five failed login attempts). Set lockout durations to a minimum of 15 minutes.
  • Use Case: Mitigates automated attack techniques that rely on repeated login attempts.

Multi-Factor Authentication (MFA) for High-Risk Accounts

  • Implementation: Require MFA for all administrative accounts and high-risk users. Use MFA mechanisms like hardware tokens, authenticator apps, or biometrics.
  • Use Case: Prevents unauthorized access, even if credentials are stolen.

Restricting Interactive Logins

  • Implementation: Restrict interactive logins for privileged accounts to specific secure systems or management consoles. Use group policies to enforce logon restrictions.
  • Use Case: Protects sensitive accounts from misuse or exploitation.

Tools for Implementation

Built-in Tools:

  • Microsoft Active Directory (AD): Centralized account management and RBAC enforcement.
  • Group Policy Object (GPO): Enforce password policies, logon restrictions, and account lockout policies.

Identity and Access Management (IAM) Tools:

  • Okta: Centralized user provisioning, MFA, and SSO integration.
  • Microsoft Azure Active Directory: Provides advanced account lifecycle management, role-based access, and conditional access policies.

Privileged Account Management (PAM):

  • CyberArk, BeyondTrust, Thycotic: Manage and monitor privileged account usage, enforce session recording, and JIT access.
SP 800-53
SP800-53-AC-2relatedvia ctid-attack-to-sp800-53
SP800-53-AC-3relatedvia ctid-attack-to-sp800-53
SP800-53-AC-5relatedvia ctid-attack-to-sp800-53
SP800-53-AC-6relatedvia ctid-attack-to-sp800-53
SP800-53-CM-2relatedvia ctid-attack-to-sp800-53
View in graphReport an issue
← Back to Persistence
Persistence80 controls
ATTACK-T1037Boot or Logon Initialization ScriptsATTACK-T1037.001Logon Script (Windows)ATTACK-T1037.002Login HookATTACK-T1037.003Network Logon ScriptATTACK-T1037.004RC ScriptsATTACK-T1037.005Startup ItemsATTACK-T1098Account ManipulationATTACK-T1098.001Additional Cloud CredentialsATTACK-T1098.002Additional Email Delegate PermissionsATTACK-T1098.003Additional Cloud RolesATTACK-T1098.004SSH Authorized KeysATTACK-T1098.005Device RegistrationATTACK-T1098.006Additional Container Cluster RolesATTACK-T1098.007Additional Local or Domain GroupsATTACK-T1133External Remote ServicesATTACK-T1136Create AccountATTACK-T1136.001Local AccountATTACK-T1136.002Domain AccountATTACK-T1136.003Cloud AccountATTACK-T1137Office Application StartupATTACK-T1137.001Office Template MacrosATTACK-T1137.002Office TestATTACK-T1137.003Outlook FormsATTACK-T1137.004Outlook Home PageATTACK-T1137.005Outlook RulesATTACK-T1137.006Add-insATTACK-T1176Software ExtensionsATTACK-T1176.001Browser ExtensionsATTACK-T1176.002IDE ExtensionsATTACK-T1505Server Software ComponentATTACK-T1505.001SQL Stored ProceduresATTACK-T1505.002Transport AgentATTACK-T1505.003Web ShellATTACK-T1505.004IIS ComponentsATTACK-T1505.005Terminal Services DLLATTACK-T1505.006vSphere Installation BundlesATTACK-T1525Implant Internal ImageATTACK-T1542.001System FirmwareATTACK-T1542.002Component FirmwareATTACK-T1542.003BootkitATTACK-T1543Create or Modify System ProcessATTACK-T1543.001Launch AgentATTACK-T1543.002Systemd ServiceATTACK-T1543.003Windows ServiceATTACK-T1543.004Launch DaemonATTACK-T1543.005Container ServiceATTACK-T1546.017Udev RulesATTACK-T1546.018Python Startup HooksATTACK-T1547Boot or Logon Autostart ExecutionATTACK-T1547.001Registry Run Keys / Startup FolderATTACK-T1547.002Authentication PackageATTACK-T1547.003Time ProvidersATTACK-T1547.004Winlogon Helper DLLATTACK-T1547.005Security Support ProviderATTACK-T1547.006Kernel Modules and ExtensionsATTACK-T1547.007Re-opened ApplicationsATTACK-T1547.008LSASS DriverATTACK-T1547.009Shortcut ModificationATTACK-T1547.010Port MonitorsATTACK-T1547.012Print ProcessorsATTACK-T1547.013XDG Autostart EntriesATTACK-T1547.014Active SetupATTACK-T1547.015Login ItemsATTACK-T1554Compromise Host Software BinaryATTACK-T1574Hijack Execution FlowATTACK-T1574.001DLLATTACK-T1574.004Dylib HijackingATTACK-T1574.005Executable Installer File Permissions WeaknessATTACK-T1574.006Dynamic Linker HijackingATTACK-T1574.007Path Interception by PATH Environment VariableATTACK-T1574.008Path Interception by Search Order HijackingATTACK-T1574.009Path Interception by Unquoted PathATTACK-T1574.010Services File Permissions WeaknessATTACK-T1574.011Services Registry Permissions WeaknessATTACK-T1574.012COR_PROFILERATTACK-T1574.013KernelCallbackTableATTACK-T1574.014AppDomainManagerATTACK-T1653Power SettingsATTACK-T1668Exclusive ControlATTACK-T1671Cloud Application Integration