tfMITRE ATT&CK technique

Server Software Component T1505

Tactic: Persistence
Platforms: Windows, Linux, macOS, Network Devices, ESXi
Version: 1.5
Created: 28 June 2019
Last modified: 24 October 2025

Sub-techniques 686 rules across the family · 4 mapped directly to T1505 · 6 of 6 carry rules

.001SQL Stored Procedures8 .002Transport Agent3 .003Web Shell54 .004IIS Components15 .005Terminal Services DLL1 .006vSphere Installation Bundles1

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Offense vs defense T1505

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 3

first rule: 2019 Q3

Server Software Component detection strategy DET0547

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for T1505 - Server Software Component

Enterprise

4 platforms

AN1507 · Windows

Installation of malicious IIS/Apache/SQL server modules that later execute command-line interpreters or establish outbound connections.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Scheduled Job CreationDC0001	WinEventLog:Security	EventCode=4698
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Application Log ContentDC0038	WinEventLog:Application	Unusual DLL/plugin registration for IIS/SQL/Apache or unexpected error logs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Time delta between module install and process execution (e.g., persistence delay).
ParentProcessName	Custom server wrapper processes or renamed webserver processes may require tuning.

AN1508 · Linux

Abuse of extensible server modules (e.g., Apache, Nginx, Tomcat) to load rogue plugins that initiate bash, connect to C2, or spawn reverse shells.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Application Log ContentDC0038	linux:syslog	Module registration or stacktrace logs indicating segmentation faults or unknown module errors
Network Traffic FlowDC0078	NSM:Flow	Outbound connections from web server binaries (apache2, nginx, php-fpm) to unknown external IPs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ServerBinaryPath	Alternate install paths like /opt/httpd or user-compiled binaries
OutboundPortRange	Tunable to match expected versus suspicious outbound traffic patterns

AN1509 · macOS

Malicious use of webserver plugins (e.g., for nginx, PHP, Node.js) that execute AppleScript or open network sockets.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Script interpreter invoked by nginx/apache worker process
Network Traffic ContentDC0085	macos:unifiedlog	Web server process initiating outbound TCP connections not tied to normal server traffic

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentBinaryPath	If homebrew or manually compiled nginx/httpd used, baseline accordingly.

AN1510 · ESXi

Use of ESXi web interface plugins or vSphere extensions to embed persistent malicious scripts or services.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	esxi:hostd	New extension/module install with unknown vendor ID
Command ExecutionDC0064	esxi:vmkernel	Unexpected restarts of management agents or shell access

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PluginVendorName	Whitelist known vendor plug-in names for extension correlation
AccessVector	Limit exposure of plugin installation via HTTPS or SSH

Server Software Component detections T1505

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs