1. Home
  2. ATT&CK Techniques
  3. T1505 Server Software Component

T1505 Server Software Component

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)

View in MITRE ATT&CK®

CIS Controls Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
CIS-6.8 Define and Maintain Role-Based Access Control mitigates T1505 Server Software Component
Comments
Using role-based access control (RBAC) to limit permissions to add or modify server software components to users with a legitimate need can help prevent adversaries from abusing legitimate extensible development features of servers.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls6/#68-define-and-maintain-role-based-access-control
CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software mitigates T1505 Server Software Component
Comments
Disabling unnecessary server extension mechanisms and components reduces the features adversaries can abuse to establish persistent server-side access.
References

    VERIS Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1505 Server Software Component
    action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1505 Server Software Component

    GCP Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    google_secops Google Security Operations technique_scores T1505 Server Software Component
    Comments
    Google Security Ops is able to trigger alerts based off suspicious events and command line arguments that could indicate an adversary tampering with system components. This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/threat_hunting/sysmon/detection_of_com_hijacking.yaral
    References
    1. https://cloud.google.com/security/products/security-operations
    2. https://cloud.google.com/chronicle/docs/secops/secops-overview
    3. https://github.com/chronicle/detection-rules

    ATT&CK Subtechniques

    Technique ID Technique Name Number of Mappings
    T1505.002 Transport Agent 4
    T1505.005 Terminal Services DLL 4
    T1505.003 Web Shell 7
    T1505.004 IIS Components 3
    T1505.006 vSphere Installation Bundles 2
    T1505.001 SQL Stored Procedures 5