Server Software Component
- ID
- T1505
- Tactics
- TA0003 Persistence
- Platforms
- Windows, Linux, macOS, Network Devices, ESXi
- Data sources
- Scheduled Job Creation, Process Creation, Application Log Content, Network Traffic Flow, Network Traffic Content, Command Execution
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.[4]
Sub-techniques (6)
- T1505.001 SQL Stored Procedures
- T1505.002 Transport Agent
- T1505.003 Web Shell
- T1505.004 IIS Components
- T1505.005 Terminal Services DLL
- T1505.006 vSphere Installation Bundles
Detection
- DET0547 Detection Strategy for T1505 - Server Software Component
Data components: Scheduled Job Creation, Process Creation, Application Log Content, Network Traffic Flow, Network Traffic Content, Command Execution
Mitigations (7)
- M1018 User Account Management
Enforce the principle of least privilege by limiting privileges of user accounts so only authorized accounts can modify and/or add server software components.[1]
- M1024 Restrict Registry Permissions
Consider using Group Policy to configure and block modifications to service and other critical server parameters in the Registry.[2]
- M1026 Privileged Account Management
Do not allow administrator accounts that have permissions to add component software on these services to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
- M1042 Disable or Remove Feature or Program
Consider disabling software components from servers when possible to prevent abuse by adversaries.[3]
- M1045 Code Signing
Ensure all application component binaries are signed by the correct application developers.
- M1046 Boot Integrity
Enabling secure boot allows validation of software and drivers during initial system boot.
- M1047 Audit
Regularly check component software on critical services that adversaries may target for persistence to verify the integrity of the systems and identify if unexpected changes have been made.
References
- NSA and ASD Detect and Prevent Web Shells 2020
- Microsoft System Services Fundamentals
- ITSyndicate Disabling PHP functions
- volexity_0day_sophos_FW