Glossaire

Les termes clés des web shells, de la détection et de la forensique, définis pour les défenseurs.

Les guides et le glossaire sont pour l'instant publiés en anglais.

Application allow-listing

Permitting only approved executables and scripts to run, blocking everything else by default.

China Chopper

A long-known, very small client-driven web shell model in which a tiny server-side file evaluates code sent by a dedicated client.

File integrity monitoring (FIM)

Detecting changes to files by comparing them against a trusted baseline of hashes, attributes and permissions.

Sigma

A generic, vendor-neutral signature format for log events that converts into queries for many SIEM platforms.

T1505.003 (MITRE ATT&CK)

The MITRE ATT&CK sub-technique Server Software Component: Web Shell, under the Persistence tactic.

Timestomping

Altering a file's timestamps to make a malicious file blend in with legitimate ones and mislead investigators.

Unrestricted file upload

A vulnerability class where an application stores uploaded files without ensuring they cannot be executed by the server.

w3wp.exe

The IIS worker process that hosts ASP.NET applications — its child processes are a key web shell detection signal.

Web application firewall (WAF)

A filter in front of web applications that inspects HTTP traffic to block attacks such as injection and malicious uploads.

Web shell

A script or module planted on a web server that turns HTTP requests into server-side actions such as command execution or file access.

Webroot

The directory tree a web server serves content from; any executable file placed there can potentially be requested and run.

YARA

A pattern-matching language and tool for identifying and classifying files by textual or binary content.