Glossary
T1505.003 (MITRE ATT&CK)
The MITRE ATT&CK sub-technique Server Software Component: Web Shell, under the Persistence tactic.
T1505.003 is the MITRE ATT&CK identifier for Server Software Component: Web Shell. It sits under the Persistence tactic and describes adversaries backdooring web servers with scripts or modules that provide remote access.
ATT&CK lists data sources for detecting it — file creation and modification, process creation from web server processes, network traffic and application logs — and mitigations such as least privilege for web server identities and disabling unused functionality. Tagging detections and incident findings with T1505.003 makes them comparable across tools and reports.