TGR-STA-1030 Web Shell Staging via Web Server File Write (T1505.003)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•6

Detects the creation of files with extensions commonly associated with web shells (.php, .aspx, .jsp) within typical web application directories by common web server processes such as httpd, nginx, php-cgi, and w3wp. This activity is indicative of a potential web shell deployment for persistent access or command execution.