Glossary

Key web shell, detection and forensics terms, defined for defenders.

Application allow-listing

Permitting only approved executables and scripts to run, blocking everything else by default.

China Chopper

A long-known, very small client-driven web shell model in which a tiny server-side file evaluates code sent by a dedicated client.

File integrity monitoring (FIM)

Detecting changes to files by comparing them against a trusted baseline of hashes, attributes and permissions.

Sigma

A generic, vendor-neutral signature format for log events that converts into queries for many SIEM platforms.

T1505.003 (MITRE ATT&CK)

The MITRE ATT&CK sub-technique Server Software Component: Web Shell, under the Persistence tactic.

Timestomping

Altering a file's timestamps to make a malicious file blend in with legitimate ones and mislead investigators.

Unrestricted file upload

A vulnerability class where an application stores uploaded files without ensuring they cannot be executed by the server.

w3wp.exe

The IIS worker process that hosts ASP.NET applications — its child processes are a key web shell detection signal.

Web application firewall (WAF)

A filter in front of web applications that inspects HTTP traffic to block attacks such as injection and malicious uploads.

Web shell

A script or module planted on a web server that turns HTTP requests into server-side actions such as command execution or file access.

Webroot

The directory tree a web server serves content from; any executable file placed there can potentially be requested and run.

YARA

A pattern-matching language and tool for identifying and classifying files by textual or binary content.