T1505.004sub-technique of T1505 Server Software Component
IIS Components
Windowsnothing on this site yetT1505.004 on attack.mitre.org
Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
Detection Strategy for T1505.004 - Malicious IIS Components
- Adversary installs or modifies IIS components (ISAPI filters, extensions, or modules) using DLL files registered via configuration changes or administrative tools like AppCmd.exe. These components intercept or manipulate HTTP requests/responses for persistence or C2.
what reduces it
- M1038 Execution Prevention. Restrict unallowed ISAPI extensions and filters from running by specifying a list of ISAPI extensions and filters that can run on IIS.
- M1045 Code Signing. Ensure IIS DLLs and binaries are signed by the correct application developers.
- M1026 Privileged Account Management. Do not allow administrator accounts that have permissions to add IIS components to be used for day-to-day operations that may expose these permissions to potential adversaries and/or other unprivileged systems.
- M1047 Audit. Regularly check installed IIS components to verify the integrity of the web server and identify if unexpected changes have been made.