T1100 - Web Shell

MITRE ATT&CK

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

November 13, 2025

Last Seen

December 11, 2025

API

T1100 Web Shell is a MITRE ATT&CK technique where an attacker deploys a web-accessible shell on a compromised web server to execute commands, maintain persistence, and pivot within the network.

Overview

Recent Events

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Clusters (3)

Related Entities

Salt Typhoon Malware Zero-day Exploit Citrix Bleed 2 Australia Telecommunications Badcandy ASA Firewalls Cisco IOS Cisco IOS XE Citrix NetScaler ADC Tomcat server

T1100 - Web Shell

Overview

Recent Events

Profile

Exploited By

Associated Malware

Campaigns

Affected Platforms

Regions

Sectors Affected

Relationships

Related Clusters (3)

FortiWeb WAF Vulnerability Enables Full Admin Control Exploitation

APT Exploits Zero-Day Vulnerabilities in Cisco and Citrix Systems

Chinese Hackers Linked to Cisco Training in Salt Typhoon Attacks

Related Articles (2)

Chinese hackers exploited Cisco training to help build Salt Typhoon attacks

Zero-day attacks against Cisco ISE, Citrix NetScaler observed

Related Entities