Server Software Component

T1505

Technique with 6 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.

Detection rules75

Rules on DetectionCode tagged with T1505 or one of its sub-techniques.

Sigma34

Rule	Level	Log source	Technique
Certificate Request Export to Exchange Webserver	critical	windows / NULL	T1505.003
Mailbox Export to Exchange Webserver	critical	windows / NULL	T1505.003
Webshell Remote Command Execution	critical	linux / NULL	T1505.003
Antivirus - Web Shell Detection Signature	high	NULL / antivirus	T1505.003
Chopper Webshell Process Pattern	high	windows / process_creation	T1505.003
Exchange Set OabVirtualDirectory ExternalUrl Property	high	windows / NULL	T1505.003
Failed MSExchange Transport Agent Installation	high	windows / NULL	T1505.002
HTTP Logging Disabled On IIS Server	high	windows / NULL	T1505.004
Linux Webshell Indicators	high	linux / process_creation	T1505.003
Shellshock Expression	high	linux / NULL	T1505.003
Suspicious ASPX File Drop by Exchange	high	windows / file_event	T1505.003
Suspicious Child Process Of SQL Server	high	windows / process_creation	T1505.003
Suspicious File Write to SharePoint Layouts Directory	high	windows / file_event	T1505.003
Suspicious IIS Module Registration	high	windows / process_creation	T1505.004
Suspicious MSExchangeMailboxReplication ASPX Write	high	windows / file_event	T1505.003
Suspicious Process By Web Server Process	high	windows / process_creation	T1505.003
Suspicious Windows Strings In URI	high	NULL / webserver	T1505.003
Webshell Detection With Command Line Keywords	high	windows / process_creation	T1505.003
Webshell Hacking Activity Patterns	high	windows / process_creation	T1505.003
Webshell ReGeorg Detection Via Web Logs	high	NULL / webserver	T1505.003
Webshell Tool Reconnaissance Activity	high	windows / process_creation	T1505.003
Windows Webshell Strings	high	NULL / webserver	T1505.003
Cisco Modify Configuration	medium	cisco / NULL	T1505
ETW Logging/Processing Option Disabled On IIS Server	medium	windows / NULL	T1505.004
IIS Native-Code Module Command Line Installation	medium	windows / process_creation	T1505.003
MSExchange Transport Agent Installation	medium	windows / process_creation	T1505.002
MSExchange Transport Agent Installation - Builtin	medium	windows / NULL	T1505.002
New Module Module Added To IIS Server	medium	windows / NULL	T1505.004
Potential Suspicious Activity Using SeCEdit	medium	windows / process_creation	T1505.005
Potential Webshell Creation On Static Website	medium	windows / file_event	T1505.003
Suspicious File Drop by Exchange	medium	windows / file_event	T1505.003
Suspicious File Write to Webapps Root Directory	medium	windows / file_event	T1505.003
Suspicious SQL Query	medium	NULL / database	T1505.001
Previously Installed IIS Module Was Removed	low	windows / NULL	T1505.004

Splunk41

Rule	Type	Risk	Data source	Technique
Cisco Configuration Archive Logging Analysis	Hunting	NULL	Cisco IOS Logs	T1505.003
Cisco Secure Firewall - Privileged Command Execution via HTTP	Anomaly	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1505.003
Confluence Unauthenticated Remote Code Execution CVE-2022-26134	TTP	NULL	Palo Alto Network Threat	T1505
Detect Exchange Web Shell	TTP	NULL	Sysmon EventID 11	T1505.003
Detect Webshell Exploit Behavior	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1505.003
ESXi Malicious VIB Forced Install	TTP	NULL	VMWare ESXi Syslog	T1505.006
Exploit Public Facing Application via Apache Commons Text	Anomaly	NULL	Nginx Access	T1505.003
Linux Suspicious Redis Activity	TTP	NULL	Sysmon for Linux EventID 1	T1505
MS Exchange Mailbox Replication service writing Active Server Pages	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 11	T1505.003
Spring4Shell Payload URL Request	TTP	NULL	Nginx Access	T1505.003
Supernova Webshell	TTP	NULL		T1505.003
Tomcat Session Deserialization Attempt	Anomaly	NULL	Nginx Access	T1505.003
Tomcat Session File Upload Attempt	Anomaly	NULL	Nginx Access	T1505.003
W3WP Spawning Shell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1505.003
Web JSP Request via URL	TTP	NULL	Nginx Access	T1505.003
Windows Disable Windows Event Logging Disable HTTP Logging	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1505.004
Windows IIS Components Add New Module	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1505.004
Windows IIS Components Get-WebGlobalModule Module Query	Hunting	NULL	Powershell Installed IIS Modules	T1505.004
Windows IIS Components Module Failed to Load	Anomaly	NULL	Windows Event Log Application 2282	T1505.004
Windows IIS Components New Module Added	TTP	NULL	Windows IIS 29	T1505.004
Windows Metasploit Confluence Plugin Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1505.003
Windows Potential Web Shell Creation For VMware Workspace ONE	Anomaly	NULL	Sysmon EventID 11	T1505.003
Windows PowerShell Add Module to Global Assembly Cache	TTP	NULL	Powershell Script Block Logging 4104	T1505.004
Windows PowerShell Disable HTTP Logging	TTP	NULL	Powershell Script Block Logging 4104	T1505.004
Windows PowerShell IIS Components WebGlobalModule Usage	Anomaly	NULL	Powershell Script Block Logging 4104	T1505.004
Windows Server Software Component GACUtil Install to GAC	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1505.004
Windows SharePoint Spinstall0 GET Request	TTP	NULL	Suricata	T1505.003
Windows SharePoint Spinstall0 Webshell File Creation	TTP	NULL	Sysmon EventID 11	T1505.003
Windows SharePoint ToolPane Endpoint Exploitation Attempt	TTP	NULL	Suricata	T1505.003
Windows Shell or Script Execution From IIS Directory	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1505.004
Windows Shell Process from CrushFTP	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1505
Windows SQL Server Configuration Option Hunt	Hunting	NULL	Windows Event Log Application 15457	T1505.001
Windows SQL Server Critical Procedures Enabled	TTP	NULL	Windows Event Log Application 15457	T1505.001
Windows SQL Server Extended Procedure DLL Loading Hunt	Hunting	NULL	Windows Event Log Application 8128	T1505.001
Windows SQL Server Startup Procedure	Anomaly	NULL	Windows Event Log Application 17135	T1505.001
Windows SQL Server xp_cmdshell Config Change	TTP	NULL	Windows Event Log Application 15457	T1505.001
Windows Sqlservr Spawning Shell	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1505.001
Windows Suspicious Child Process Spawned From WebServer	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1505.003
Windows TeamCity Payload Execution from Temp Directory	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1505.003
Windows TeamCity Plugin Installed	Anomaly	NULL	Sysmon EventID 11	T1505.003
Windows WSUS Spawning Shell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1505.003

Sub-techniques6

ID	Name	Examples
T1505.001	SQL Stored Procedures	2
T1505.002	Transport Agent	1
T1505.003	Web Shell	66
T1505.004	IIS Components	5
T1505.005	Terminal Services DLL	0
T1505.006	vSphere Installation Bundles	2

Groups0

None recorded.

Software0

None recorded.

Campaigns0

None recorded.

Procedure examples0

No procedure examples are recorded for this technique.

References1

volexity_0day_sophos_FW Open source
Adair, S., Lancaster, T., Volexity Threat Research. (2022, June 15). DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach. Retrieved July 1, 2022.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.