How to detect web shell attacks

In this page

Threat snapshot

A web shell is a script file placed on a web server that provides the attacker with a persistent, browser-accessible backdoor into the server environment. Once installed, it converts the web server into an interactive command execution environment accessible over HTTP or HTTPS using nothing more than a web browser. There is no C2 infrastructure to track, no beacon traffic to detect, and no unusual process making outbound connections. The attacker sends HTTP requests to the web shell URL and the server responds with command output.

Web shells are installed through web application vulnerabilities (file upload flaws, deserialization bugs, SQL injection with file write permissions), exploitation of known CVEs in web-facing products (Exchange, IIS, Apache, Tomcat), and through compromised credentials for web application admin panels. Once a shell is in place, attackers use it for reconnaissance, credential dumping, lateral movement, and as a stable re-entry point that survives password resets and endpoint remediation if the shell file itself is not found.

The primary detection signal is an anomalous parent-child process relationship: the web server worker process (w3wp.exe for IIS, httpd.exe for Apache, java.exe for Tomcat) spawning a command shell (cmd.exe, PowerShell), a system utility (net.exe, whoami.exe, ipconfig.exe), or any other unexpected child process. Web server worker processes serve HTTP requests by executing application code; they should never legitimately spawn system administration utilities. When they do, it is the most reliable signal that a web shell is receiving and executing commands.

Log360 maps 6 detection rules to web shell installation and execution, covering the core IIS and Windows-based web shell patterns alongside log deletion activity used to cover web shell access traces.

Web shell detection, at a glance

Severity Critical
Category Endpoint & Malware
MITRE ATT&CK tactic TA0003 Persistence, TA0002 Execution
MITRE technique T1505.003 Web Shell
Detection vectors Web server worker process spawning system utilities, IIS log deletion, suspicious file creation in web directories, IIS credential dumping
Platforms covered Windows
Log360 detection rules 6 rules
SOC maturity level Level 3 - Incident Response
Compliance mapping NIST CSF DE.CM-1, PCI-DSS 6.4, HIPAA Section 164.308(a)(1), ISO 27001 A.12.6.1

How web shell attacks work

Installation through vulnerability exploitation

The most common web shell delivery path is exploitation of a web application vulnerability or a known CVE in web server software. Exchange Server vulnerabilities (ProxyShell, ProxyLogon), IIS vulnerabilities, and web application file upload flaws have all been used to drop web shells at scale. The shell is typically a small ASPX, PHP, JSP, or CFML file containing a code execution routine. The file is written to the web application's document root or a subdirectory, making it accessible via HTTP.

Command execution through the web server process

When a request is sent to the web shell URL, the web server executes the shell script within the context of the web server worker process. Commands submitted in the HTTP request body or query string are passed to a system shell for execution. The resulting output is returned in the HTTP response. From the web server's process perspective, this appears as the worker process (w3wp.exe) spawning cmd.exe or PowerShell with the attacker's command as arguments. This parent-child relationship is the detection signal.

IIS log deletion for cover

After using a web shell, attackers often delete IIS access logs to remove evidence of their requests to the shell URL. IIS logs record every HTTP request including the URL path, source IP, user agent, and response code. Deleting these logs removes the record of the web shell's location and the attacker's access history. The IIS WebServer Access Logs Deleted and Disable Windows IIS HTTP Logging rules detect this post-exploitation cleanup activity.

Credential dumping via web shell access

With command execution through the web server process, attackers frequently attempt to dump IIS-related credentials from configuration files or memory. The Microsoft IIS Connection Strings Decryption and Microsoft IIS Service Account Password Dumped rules detect the specific techniques used to extract credentials from IIS application configurations and the IIS service account context.

Real-world campaigns

ProxyShell and ProxyLogon: Exchange Server web shell deployment at scale

The ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyLogon (CVE-2021-26855, CVE-2021-27065) vulnerability chains enabled unauthenticated attackers to write ASPX web shells to Exchange Server's web directories at scale. Multiple ransomware groups and APTs exploited these vulnerabilities to deploy web shells on Exchange servers globally within days of exploitation details becoming public. The web shell deployment created a persistent backdoor that survived Exchange patching in environments that did not audit their web directories for unexpected files.

Chinese APT groups: IIS web shells for long-term persistence

Several Chinese APT groups have a documented pattern of deploying web shells on IIS-based web servers as long-term persistence mechanisms, maintaining access for months or years before being detected. These shells are often placed in directories that receive infrequent attention from administrators and are named to blend in with legitimate application files. Their presence is typically only discovered during forensic investigation after another incident, when web directory audits are performed.

Ransomware initial access via web shells

Multiple ransomware groups have used web shells as their initial access vector, exploiting public-facing web applications to deploy a shell, then using the shell for reconnaissance and lateral movement to reach the broader network before deploying their encryptor. The web shell provides a stable re-entry point even if initial endpoint detection occurs.

Business impact

  • Web shells provide persistent access that survives most standard remediation actions: Password resets, account disablement, and endpoint malware removal do not remove a web shell if its file location is not identified. Attackers can return through the shell after any of these actions. The web server must be audited for unexpected files as part of any remediation process.
  • Web server processes often run with elevated privileges that amplify post-exploitation impact: IIS application pool accounts may have database access, file system access, or network permissions that enable lateral movement beyond the web server itself. A web shell running in the context of an overprivileged IIS service account can reach internal resources that the web application itself accesses.
  • Web shell access traffic can be indistinguishable from legitimate HTTP traffic at the network layer: Because web shells respond to standard HTTP requests, their traffic uses the same ports and protocols as legitimate web traffic. Network-layer monitoring cannot reliably distinguish web shell commands from legitimate user requests without access to the specific URL paths and request parameters.

Detecting web shell attacks with Log360

Web shell detection relies on Windows Security Event 4688 (process creation with command-line logging) or Sysmon Event 1. The key events are w3wp.exe (or the relevant web server worker process) appearing as a parent process for cmd.exe, PowerShell, or system administration utilities. Web server access logs must also be collected into Log360 to provide the HTTP request context that explains what URL was accessed to trigger the process creation.

Rule name Severity Platform MITRE technique What it detects
IIS WebServer Access Logs Deleted Trouble Windows T1070 Deletion of IIS access log files, used by attackers to remove the record of their web shell access requests and cover their activity after using the shell.
Disable Windows IIS HTTP Logging Trouble Windows T1562.002 Registry or IIS configuration change that disables HTTP access logging, preventing future access log entries from being written and blinding forensic reconstruction of web shell usage.
Microsoft IIS Connection Strings Decryption Trouble Windows T1003 Execution of the aspnet_regiis utility or equivalent to decrypt IIS application configuration connection strings, used to extract database credentials and other secrets from web application configuration files.
Microsoft IIS Service Account Password Dumped Trouble Windows T1003 Credential dumping targeting the IIS service account, used to extract the IIS AppPool or service account credentials for use in lateral movement beyond the web server.
IIS FTP server Privileged Command Execution Anomaly Attention Miscellaneous T1071.002 Anomalous privileged command execution through the IIS FTP service, indicating potential FTP-delivered web shell or FTP service exploitation.
Suspicious Password Change Activity on IIS FTP Server Attention Miscellaneous T1556.001 Password change activity through the IIS FTP interface that deviates from normal administrative patterns, indicating potential attacker manipulation of FTP server credentials.

Attack chain visibility

Step Log source and event What it indicates Time offset
1 IIS access log - HTTP POST or GET to an unexpected .aspx, .php, or .jsp file path in the web root Initial web shell access. The URL path to the shell file is visible in IIS access logs. The HTTP status code (200) confirms the shell is responding. This event may occur days to weeks after the shell was installed. T+0 (first use)
2 Windows Event 4688 / Sysmon Event 1 - w3wp.exe spawning cmd.exe or PowerShell Command execution through the web shell. The worker process parent is the definitive signal. The child process command line contains the attacker's command. This event confirms an active web shell is receiving commands. T+concurrent with step 1
3 Windows Event 4688 - net.exe, whoami.exe, ipconfig.exe, or similar reconnaissance utilities spawned by w3wp.exe Reconnaissance commands executing through the shell. The attacker is enumerating the server environment, identifying network configuration, user accounts, and available paths for further access. T+minutes after step 2
4 Windows Event 4688 - credential dumping tools or IIS configuration decryption utilities spawned by w3wp.exe Credential theft via web shell context. Microsoft IIS Connection Strings Decryption rule fires. The attacker is extracting credentials for lateral movement. T+minutes to hours after step 3
5 Windows Event 4663 or file system event - IIS access log files deleted Log cover-up. IIS WebServer Access Logs Deleted fires. The attacker is removing evidence of their access. This event confirms the web shell was used and the attacker is now covering their tracks. T+variable - may occur before the attacker leaves or on subsequent access

Investigation playbook

Step 1: Identify the web shell file and URL

  • From the process creation events showing w3wp.exe as parent, work backward to the IIS access logs at the same timestamp. The HTTP request that triggered the process creation will identify the web shell URL path. The file path of the shell is the primary artifact needed to remove it.
  • Query IIS access logs for all requests to the identified URL path for the past 90 days. This timeline reveals when the shell was first accessed (which may be earlier than the process creation events if the shell was installed but not used for some time), all source IPs that have accessed it, and the frequency of use.
  • Audit the web server's document root directories for all recently modified or created script files (.aspx, .php, .jsp, .cfm, .ashx). Shell files are often created at the time of exploitation and may not have been accessed until later. File creation timestamps in the web root that coincide with known vulnerability exploitation dates are high-priority suspects.

Step 2: Assess post-exploitation activity

  • From the IIS access log timeline, identify all commands executed through the shell by examining process creation events on the web server host across the entire shell usage period. Compile a list of every command that ran, the accounts accessed, and the network connections made from the web server process.
  • Check whether the web server process made any outbound connections during the shell usage period. Lateral movement from the web server context may appear as SMB connections, authentication events to internal hosts, or LDAP queries to domain controllers.

Response and remediation

Immediate actions

  • Take the web server offline or isolate it from the internal network while the investigation is active: A web shell provides the attacker with an interactive session. Leaving the server network-connected while investigating means the attacker can continue to operate and may accelerate their activity in response to detection.
  • Do not simply delete the web shell file as the first action: The shell file is forensic evidence. Image the web server before any cleanup actions. The file's contents, creation timestamp, and any associated files in the same directory are needed for full investigation.
  • Rotate all credentials that were accessible from the web server process context: This includes database connection string credentials, IIS service account credentials, and any application-level credentials stored in web.config or similar files. The Microsoft IIS Connection Strings Decryption rule firing means these credentials should be assumed compromised.
False positive source Rules affected Tuning strategy
Scheduled log rotation or archiving IIS WebServer Access Logs Deleted Allowlist the specific service account and process used for log rotation. Alert on IIS log deletion from any other account or process, or at any time outside the scheduled log rotation window.
Legitimate IIS configuration management tools Microsoft IIS Connection Strings Decryption Allowlist the specific accounts used by IIS configuration management. This tool has very limited legitimate use outside of configuration management tasks. Any execution from an account not in the allowlist should alert regardless of time of day.