0xAnalyst / webshells
webshells
ASPX webshells written for EDR and YARA detection testing. Each shell targets a specific telemetry source or detection gap. For use in isolated lab environments only.
Defensive research ASPX / .NET IIS EDR testing SIEM testing YARA
19
Shells
5
Categories
12
ATT&CK TTPs
2
Original shells
Target: EDR SIEM Both
Filter:
📁 Original shells 2 files
Both
Poweraspx.aspx
PowerShell execution via ASPX. Tests w3wp.exe → powershell.exe parent-chain detection.
T1059.001View →
EDR
CreateProcessWebshell.aspx
P/Invoke kernel32!CreateProcess. Tests DllImport and direct process creation signatures.
T1059 · T1106View →
⚙️ Execution evasion execution-evasion/ 3 files
Both
COMShell.aspx
WScript.Shell via late-bind COM. Breaks w3wp.exe chain — no cmd.exe spawn.
T1559.001View →
Both
WMIShell.aspx
Win32_Process.Create — fully detached, parent PID is WMI not IIS.
T1047View →
EDR
MSBuildShell.aspx
Drops and runs a .proj via MSBuild.exe. Tests LOLBin and trusted binary abuse.
T1127.001View →
EDR
CreateProcess_Dynamic.aspx
kernel32!CreateProcessA via GetProcAddress — no static DllImport, no cleartext API names. Defeats static YARA string rules.
T1106 · T1027View →
EDR
ShellExecuteEx_Runas.aspx
shell32!ShellExecuteEx with runas + SW_HIDE. Avoids CreateProcess logging, runs under different user context with minimal command-line visibility.
T1548.002 · T1106View →
EDR
CreateProcessAsUser_Impersonate.aspx
advapi32!CreateProcessAsUser with impersonated token + CREATE_SUSPENDED. Breaks process lineage — no parent-child relation to w3wp.exe.
T1134.001 · T1055View →
🔒 Obfuscation obfuscation/ 2 files
EDR
XorShell.aspx
XOR + base64 runtime decode. Defeats static YARA string rules — forces behavioral detection.
T1027View →
EDR
RoslynShell.aspx
CSharpScript.EvaluateAsync — compiles C# at runtime. No disk write, no static signature.
T1027.010View →
EDR
InMemory_Assembly_XOR.aspx
XOR-encoded .NET assembly loaded via Assembly.Load — no file on disk, static analysis bypass via encoding. Uses System.Diagnostics.Process via reflected assembly.
T1027 · T1620View →
💉 Process injection injection/ 2 files
EDR
ReflectivePEShell.aspx
In-memory PE load without LoadLibrary or disk write. Tests NtProtectVirtualMemory scanning.
T1620View →
EDR
SyscallShell.aspx
Direct NtAllocateVirtualMemory syscall stubs. Bypasses user-mode EDR hooks entirely.
T1055View →
EDR
WinExec_Syscall.aspx
ntdll!NtCreateProcess via direct syscall using Heaven's Gate stub — no ntdll in memory. Bypasses EDR user-land hooks completely.
T1055 · T1562.006View →
📡 Network / C2 network-c2/ 2 files
SIEM
DoHShell.aspx
Commands in DNS-over-HTTPS queries on port 443. Tests SIEM coverage beyond port-53 DNS.
T1071.004View →
SIEM
WebSocketShell.aspx
Persistent bidirectional WebSocket channel. Tests long-lived connection detection from w3wp.exe.
T1071.001View →
🛡️ Defense evasion defense-evasion/ 2 files
EDR
ETWPatchShell.aspx
EtwEventWrite nop-patch — blinds ETW-based EDR telemetry. Tests tamper-protection coverage.
T1562.006View →
EDR
AMSIPatchShell.aspx
AmsiScanBuffer patch — disables AMSI scanning in-process. Tests AMSI tamper detection rules.
T1562.001View →
EDR
NtCreateProcess_Unhook.aspx
Fresh ntdll mapped from disk, EDR hooks removed before NtCreateProcess invocation. Tests whether EDR detects clean-copy unhooking.
T1562.001 · T1055View →
EDR
WMI_Com_ETW_AMSI_Patch.aspx
In-process AMSI + ETW patching before Win32_Process.Create via COM. Disables script scanning and ETW logging in one shell — combined evasion test.
T1562.001 · T1562.006 · T1047View →
⚠️ For authorized security testing and EDR/SIEM validation in controlled lab environments only. Unauthorized use against systems you do not own or have explicit permission to test is illegal.