ATT&CK T1505.003 - China Chopper Web Shell Pattern

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects the presence of a common China Chopper web shell pattern in HTTP client body content. Specifically, it looks for the string "eval(base64_decode(" (case-insensitive) within HTTP requests flowing to the server. This pattern is characteristic of how China Chopper web shells execute commands on compromised web servers.