Applied Cybernetics Group
T1505 Server Software Component
- Technique
T1505- Tactics
- Persistence
- Research, 90 days
- 0
- KEV CVEs mapped
- 2
- SigmaHQ rules
- 1
- Elastic, Splunk
- 36
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1505
MITRE description
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Detection coverage
SigmaHQ community rules
- Cisco Modify Configuration (core)
Elastic and Splunk rules
- Potential SAP NetWeaver WebShell Creation (elastic)
- Potential SAP NetWeaver Exploitation (elastic)
- Initial Access via File Upload Followed by GET Request (elastic)
- Web Server Potential Command Injection Request (elastic)
- Web Server Potential SQL Injection Request (elastic)
- AWS Bedrock Agent Created by IAM User or Root (elastic)
- AWS Bedrock Agent or Action Group Manipulation (elastic)
- AWS Bedrock Third-Party or External Knowledge Base Associated to Agent (elastic)
- Web Server Exploitation Detected via Defend for Containers (elastic)
- Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation (elastic)
- Simple HTTP Web Server Connection (elastic)
- Simple HTTP Web Server Creation (elastic)
- File with Suspicious Double Extension Created by Web Server (elastic)
- File with High Entropy Created by Web Server (elastic)
- Potential Polyglot Bypass File Created by Web Server (elastic)
- PHP File Creation in WordPress Plugin Directory (elastic)
- Suspicious Child Execution via Web Server (elastic)
- Suspicious Command Execution via Web Server (elastic)
- Unusual Child Execution via Web Server (elastic)
- Unusual Command Execution via Web Server (elastic)
- Unusual File Creation via Web Server (elastic)
- MySQL User-Defined Function Injection (elastic)
- Microsoft Exchange Server UM Writing Suspicious Files (elastic)
- Microsoft Exchange Worker Spawning Suspicious Processes (elastic)
- Windows Server Update Service Spawning Suspicious Processes (elastic)
Showing 25 of 36.