MITRE ATT&CKtechnique

T1505 Server Software Component

Published 2019-06-28 Modified 2025-10-24 Official page ↗

Domain: enterprise
Tactics: Persistence
Platforms: Windows, Linux, macOS, Network Devices, ESXi
Version: 1.5
Created: 2019-06-28

Description

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.

Tactic · MITRE ATT&CK (1)

TA0003 Persistence tactic

Referenced by MITRE ATT&CK · mitigates (7)

M1042 Disable or Remove Feature or Program mitigation
M1045 Code Signing mitigation
M1046 Boot Integrity mitigation
M1047 Audit mitigation
M1018 User Account Management mitigation
M1024 Restrict Registry Permissions mitigation
M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · subtechnique of (6)

T1505.006 vSphere Installation Bundles sub-technique
T1505.005 Terminal Services DLL sub-technique
T1505.004 IIS Components sub-technique
T1505.003 Web Shell sub-technique
T1505.001 SQL Stored Procedures sub-technique
T1505.002 Transport Agent sub-technique

Referenced by MITRE ATT&CK · uses (1)

C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign

Referenced by Compliance · mitigates (23)

CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1
CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
NIST-AC-2 Account Management NIST 800-53 control
NIST-AC-3 Access Enforcement NIST 800-53 control
NIST-AC-5 Separation of Duties NIST 800-53 control
NIST-AC-6 Least Privilege NIST 800-53 control
NIST-CM-11 User-installed Software NIST 800-53 control
NIST-CM-2 Baseline Configuration NIST 800-53 control
NIST-CM-5 Access Restrictions for Change NIST 800-53 control
NIST-CM-6 Configuration Settings NIST 800-53 control
NIST-CM-8 System Component Inventory NIST 800-53 control
NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
NIST-SA-10 Developer Configuration Management NIST 800-53 control
NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
NIST-SC-16 Transmission of Security and Privacy Attributes NIST 800-53 control
NIST-SI-14 Non-persistence NIST 800-53 control
NIST-SI-4 System Monitoring NIST 800-53 control
NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
NIST-SR-11 Component Authenticity NIST 800-53 control
NIST-SR-4 Provenance NIST 800-53 control
NIST-SR-5 Acquisition Strategies, Tools, and Methods NIST 800-53 control

References

https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/ volexity_0day_sophos_FW
https://www.us-cert.gov/ncas/alerts/TA15-314A US-CERT Alert TA15-314A Web Shells