T1505
Server Software Component
Windows · Linux · macOS · Network Devices · ESXi4 pieces on this siteT1505 on attack.mitre.org
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Web shell on a public-facing server
An unfamiliar file in a web root, a web server process spawning a shell, or outbound traffic from a machine that should only ever receive it.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
YARA triage samples: five heuristic rules for a web root, a script directory or a triage collection
Request-fed web shells in PHP and ASP.NET, PowerShell that decodes, executes and reaches the network in one file, ransom notes, and LSASS minidumps left on disk. Hunting rules that produce files to open, not verdicts.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
A file transfer appliance wrote a file to itself
Say what happened, in what order, and what you need to establish before anybody says the word "contained".
Read
Analyses, case studies, guides, references and interview questions.
Case study: one appliance, and the disclosure that followed
CL0P against MOVEit Transfer, worked as a case rather than read as news. A zero-day in an internet-facing file transfer product, a web shell, and a scope question that has nothing to do with how many hosts were touched. Nine questions, and the answers are in the advisory.
how MITRE says to see it
Detection Strategy for T1505 - Server Software Component
- Installation of malicious IIS/Apache/SQL server modules that later execute command-line interpreters or establish outbound connections.
- Abuse of extensible server modules (e.g., Apache, Nginx, Tomcat) to load rogue plugins that initiate bash, connect to C2, or spawn reverse shells.
- Malicious use of webserver plugins (e.g., for nginx, PHP, Node.js) that execute AppleScript or open network sockets.
- Use of ESXi web interface plugins or vSphere extensions to embed persistent malicious scripts or services.
what reduces it
- M1045 Code Signing. Ensure all application component binaries are signed by the correct application developers.
- M1046 Boot Integrity. Enabling secure boot allows validation of software and drivers during initial system boot.
- M1018 User Account Management. Enforce the principle of least privilege by limiting privileges of user accounts so only authorized accounts can modify and/or add server software components.
- M1026 Privileged Account Management. Do not allow administrator accounts that have permissions to add component software on these services to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
- M1024 Restrict Registry Permissions. Consider using Group Policy to configure and block modifications to service and other critical server parameters in the Registry.
- M1047 Audit. Regularly check component software on critical services that adversaries may target for persistence to verify the integrity of the systems and identify if unexpected changes have been made.