Netskope Threat Labs

WebShell

ATP Sandbox Adv. HeuristicsAVNetskope IPS

WebShell refers to malicious scripts uploaded to web servers that provide cyberattackers with remote command execution capabilities.

First seen
January 2022
Last seen
October 2026
Webshell
Alert Name
Application.PHP.Webshell.BW
Backdoor.Asp.Webshell.AA
Backdoor.Asp.Webshell.D
Backdoor.Asp.Webshell.F
Backdoor.Asp.Webshell.L
Backdoor.Asp.Webshell.M
Backdoor.Asp.Webshell.T
Backdoor.Asp.Webshell.X
Backdoor.Perl.Webshell.A
Backdoor.Perl.Webshell.B
Signature Name
MALWARE-BACKDOOR Php.Webshell.Agent inbound connection attempt
MALWARE-BACKDOOR Php.Webshell.Agent outbound connection attempt
MALWARE-BACKDOOR Php.Webshell.AntSword transfer attempt
MALWARE-BACKDOOR Php.Webshell.Generic download attempt
MALWARE-BACKDOOR Unix.Webshell.Generic inbound connection attempt
MALWARE-CNC Asp.Webshell.Generic inbound connection
MALWARE-CNC Html.Webshell.PhaseJAM webshell connection attempt
MALWARE-CNC Php.Webshell.Agent outbound connection
MALWARE-CNC Php.Webshell.IronShell outbound connection
MALWARE-CNC Php.Webshell.MARIJUANA inbound connection