tfMITRE ATT&CK sub-technique

IIS Components T1505.004

sub-technique of T1505 Server Software Component

Tactic: Persistence
Platform: Windows
Version: 1.1
Created: 03 June 2021
Last modified: 24 October 2025
Contributor: Wes Hurd

Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions: Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}. IIS modules may also be installed to extend IIS web servers.[1][2][3][4]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 16%

Detection rules84th percentile · 84% of ATT&CK techniques have this many detection rules written or fewer.

IIS Components MITRE reference T1505.004

Top 17%of all ATT&CK techniques for number of campaigns

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

SharePoint ToolShell ExploitationC0058 ↗

During SharePoint ToolShell Exploitation, threat actors modified Internet Information Services (IIS) components to load suspicious .NET assemblies for persistence.1

2025

Operation Dream JobC0022 ↗

During Operation Dream Job, Lazarus Group targeted Windows servers running Internet Information Systems (IIS) to install C2 components.1

2019–2020

All 2 campaigns for this technique

Offense vs defense T1505.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 5Splunk ESCU (cumulative) · 10

first rule: 2021 Q3 · 2 of 2 campaigns plotted

IIS Components detection strategy DET0068

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for T1505.004 - Malicious IIS Components

Enterprise

1 platform

AN0184 · Windows

Adversary installs or modifies IIS components (ISAPI filters, extensions, or modules) using DLL files registered via configuration changes or administrative tools like AppCmd.exe. These components intercept or manipulate HTTP requests/responses for persistence or C2.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Application Log ContentDC0038	WinEventLog:System	Changes to applicationhost.config or DLLs loaded by w3wp.exe
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File ModificationDC0061	WinEventLog:Security	EventCode=4663, 4670, 4656
Service ModificationDC0065	WinEventLog:Microsoft-IIS-Configuration	Module or ISAPI filter registration events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Adjustable time frame for detecting chained events (e.g., config change + module load)
UserContext	Scope detection to specific users or roles allowed to modify IIS components
WatchedPaths	Specific directories such as %windir%\System32\inetsrv\ for DLL monitoring
DLLNameEntropyThreshold	Entropy or name patterns to flag suspicious DLLs registered as components
ParentProcessName	Restrict to DLLs loaded by w3wp.exe or invoked via AppCmd.exe

Tests2Executorscmd 1 · PowerShell 1Need elevation0 of 2Have prerequisites2Have cleanup2Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Install IIS Module using AppCmd.exe

windows

cmd

—

Yes

The following Atomic will utilize AppCmd.exe to install a new IIS Module. IIS must be installed. This atomic utilizes a DLL on disk, but to test further suspiciousness, compile and load IIS-Raid. A successful execution will install a module into IIS using AppCmd.exe. Managing and installing Modules Reference IIS Modules

Input arguments

Name	Type	Default	Description
dll_path	path	%windir%\system32\inetsrv\defdoc.dll	The path to the DLL to be loaded
module_name	string	DefaultDocumentModule_Atomic	The name of the IIS module

Attack command

%windir%\system32\inetsrv\appcmd.exe install module /name:#{module_name} /image:#{dll_path}

Cleanup command

%windir%\system32\inetsrv\appcmd.exe uninstall module #{module_name}

Prerequisite

IIS must be installed in order to add a module to IIS.

Check

$service = get-service w3svc -ErrorAction SilentlyContinue
if($service){ Write-Host "IIS installed on $env:computername" } else { Write-Host "IIS is not installed on $env:computername" }

Satisfy

Install IIS to continue.

GUID3c829773-a22a-45e6-9c60-813edd1006e7

Install IIS Module using PowerShell Cmdlet New-WebGlobalModule

windows

PowerShell

—

Yes

The following Atomic will utilize PowerShell Cmdlet New-WebGlobalModule to install a new IIS Module. IIS must be installed. This atomic utilizes a DLL on disk, but to test further suspiciousness, compile and load IIS-Raid. A successful execution will install a module into IIS using New-WebGlobalModule. Managing IIS Modules with PowerShell IIS Modules

Input arguments

Name	Type	Default	Description
dll_path	path	%windir%\system32\inetsrv\defdoc.dll	The path to the DLL to be loaded
module_name	string	DefaultDocumentModule_Atomic	The name of the IIS module

Attack command

New-WebGlobalModule -Name #{module_name} -Image #{dll_path}

Cleanup command

Remove-WebGlobalModule -Name #{module_name}

Prerequisite

IIS must be installed in order to add a module to IIS.

Check

$service = get-service w3svc -ErrorAction SilentlyContinue
if($service){ Write-Host "IIS installed on $env:computername" } else { Write-Host "IIS is not installed on $env:computername" }

Satisfy

Install IIS to continue.

GUID8b2f83dd-97b2-449c-9f3e-e51826e4a8ec

Tests from Atomic Red Team (MIT licence) · technique definition

IIS Components detections T1505.004

15 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 16%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs