BIOC
Informational
✕
Potential web shell installation
A web-app script file was installed on a web server. This can indicate an installation of web shell.
- Module:
- Platform Analytics
- Agent event type:
- File
- Category:
- Persistence
- Status:
- Enabled
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Server Software Component: Web Shell (T1505.003)
Indicator:
File action type = create , write AND file path = /var/www/html/*.php , /var/www/html/*.asp , /var/www/html/*.aspx , /var/www/html/*.cfm , /var/www/html/*.jsp , /var/www/html/*.pl
Preventable: yes