Microsoft DART Finds Web Shell Threat on the Rise

guest · Feb 4, 2020

Microsoft DART Finds Web Shell Threat on the Rise
Various APT groups are successfully using Web shell attacks on a more frequent basis
February 4, 2020
https://www.darkreading.com/attacks...s-web-shell-threat-on-the-rise/d/d-id/1336966

An investigation into the breach of a customer's Web server by Microsoft's Detection and Response Team (DART) found a Web shell attack that had succeeded in moving through most of the ATT&CK matrix before being remediated.

The Web shell was part of an attack that placed files in numerous directories on the Web server, gaining persistence and beginning to spread laterally in the infrastructure before it was discovered, DART notes.
DART also says it is seeing Web shells used more frequently by APT groups, including Zinc, Krypton, and Gallium.

And the threat is growing: "Every month, Microsoft Defender Advanced Threat Protection (ATP) detects an average of 77,000 web shell and related artifacts on an average of 46,000 distinct machines," DART says.
Click to expand...

Microsoft: Ghost in the shell: Investigating web shell attacks

Log in or Sign up

Microsoft DART Finds Web Shell Threat on the Rise

guest Guest

Log in or Sign up

Microsoft DART Finds Web Shell Threat on the Rise

guest Guest

Useful Searches