Detect and Prevent Web Shell Malware

← Back to document page

U/OO/134094-20 PP-20-0901 21 APRIL 2020 Cybersecurity Information National Security Agency Detect and Prevent Web Shell Malware Summary Cyber actors have increased the use of web Shell Malware for computer network exploitation [1][2][3][4]. Web Shell Malware is software deployed by a hacker, usually on a victim s web server. It can be used to execute arbitrary system commands, which are commonly sent over HTTP or HTTPS. Web Shell attacks pose a serious risk to DoD components. Attackers often create web shells by adding or modifying a file in an existing web application. Web shells provide attackers with persistent access to a compromised network using communication channels disguised to blend in with legitimate traffic. Web Shell Malware is a long-standing, pervasive threat that continues to evade many security tools.

Apr 22, 2020 · techniques include: Web Application Update Prioritization . Attackers sometimes target vulnerabilities in internet-facing and internal web applications within 24 hours of a patch release. Update these applications as soon as patches are available. Whenever possible, enable automatic updating and configure frequent update cadence (at least daily).

  Technique, Shell, Prevent, Malware, Prioritization, And prevent web shell malware