T1505 — Server Software Component
Parent technique
Description
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.
Sub-techniques
- T1505.001 — SQL Stored Procedures
- T1505.002 — Transport Agent
- T1505.003 — Web Shell
- T1505.004 — IIS Components
- T1505.005 — Terminal Services DLL
- T1505.006 — vSphere Installation Bundles
Detected by EasySIEM
This project's own SigmaHQ-derived detection pipeline tags every compiled rule with the ATT&CK technique(s) it maps to -- if a rule in your install covers this technique, it shows up automatically on your own Grafana Alerts dashboard's "Top ATT&CK Techniques" panel, no lookup needed. This page exists so a click from there always lands here on easysiem.com, not on attack.mitre.org.