A Web Shell is a file containing backdoor functionality written in a web scripting language such ASP, ASPX, PHP or JSP. When a web shell is hosted on an internet facing victim system, an adversary can remotely access the system to perform malicious actions. Deep Panda is a China based threat group CrowdStrike has observed targeting companies in the defense, legal, telecommunication and financial industries. Crowdstrike has observed Deep Panda adopting web shells as their primary access back into a victim organization. This is an interesting shift as web shells have typically been seen as only a first stage into obtaining a persistent foothold in an environment. Previously, web shells were quickly abandoned once persistent second stage malware was successfully beaconing. Using a web shell as a primary backdoor gives Deep Panda several advantages