MITRE ATT&CKsub-technique

T1505.004 IIS Components

Published 2021-06-03 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Persistence
Platforms
Windows
Version
1.1
Created
2021-06-03

Description

Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions: Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}. IIS modules may also be installed to extend IIS web servers. Adversaries may install malicious ISAPI extensions and filters to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic. ISAPI extensions and filters may have access to all IIS web requests and responses. For example, an adversary may abuse these mechanisms to modify HTTP responses in order to distribute malicious commands/content to previously comprised hosts. Adversaries may also install malicious IIS modules to observe and/or modify traffic. IIS 7.0 introduced modules that provide the same unrestricted access to HTTP requests and responses as ISAPI extensions and filters. IIS modules can be written as a DLL that exports RegisterModule, or as a .NET application that interfaces with ASP.NET APIs to access IIS HTTP requests.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1505 Server Software Component technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (4)

  • M1038 Execution Prevention mitigation
  • M1045 Code Signing mitigation
  • M1047 Audit mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (5)

  • C0058 SharePoint ToolShell Exploitation campaign
  • C0022 Operation Dream Job campaign
  • S1022 IceApple software (malware)
  • S0258 RGDoor software (malware)
  • S0072 OwaAuth software (malware)

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-698 Install Malicious Extension attack pattern

Referenced by Compliance · mitigates (24)

  • CIS-2.6 Allowlist Authorized Libraries CIS Safeguard v8.1
  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-14 Non-persistence NIST 800-53 control
  • NIST-SI-16 Memory Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
  • NIST-SR-11 Component Authenticity NIST 800-53 control
  • NIST-SR-4 Provenance NIST 800-53 control
  • NIST-SR-5 Acquisition Strategies, Tools, and Methods NIST 800-53 control

References