T1505 · Server Software Component

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1505 · Server Software Component · Sunturai

attack-patternenterprise-attackT1505

Server Software Component

attack-pattern--d456de47-a16f-4e46-8980-e67478a12dcb

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)

Created: Jun 28, 2019, 5:52 PM UTC
Modified: Oct 24, 2025, 5:49 PM UTC

6 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

63 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Web Shell Detection: Script Process Child of Common Web Processes	High	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
Execution via MSSQL xp_cmdshell Stored Procedure	Medium	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
Suspicious Command Execution via Web Server	Medium	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
Suspicious Child Execution via Web Server	Medium	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
AWS Bedrock Third-Party or External Knowledge Base Associated to Agent	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
AWS Bedrock Agent or Action Group Manipulation	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
AWS Bedrock Agent Created by IAM User or Root	Low	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Unusual File Creation via Web Server	Low	Elastic detection rules	Sep 29, 2026	Elastic License 2.0
Unsigned DLL loaded by DNS Service	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential IIS Web Shell File Creation	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
ScreenConnect Server Spawning Suspicious Processes	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Windows Server Update Service Spawning Suspicious Processes	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Microsoft Exchange Worker Spawning Suspicious Processes	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Microsoft Exchange Server UM Writing Suspicious Files	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
MySQL User-Defined Function Injection	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Command Execution via Web Server	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Child Execution via Web Server	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
PHP File Creation in WordPress Plugin Directory	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Polyglot Bypass File Created by Web Server	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
File with High Entropy Created by Web Server	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
File with Suspicious Double Extension Created by Web Server	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Simple HTTP Web Server Creation	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Simple HTTP Web Server Connection	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Web Server Exploitation Detected via Defend for Containers	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 25 of 63

Filter in the catalogue

External references

mitre-attackT1505Open reference

volexity_0day_sophos_FWOpen reference

US-CERT Alert TA15-314A Web ShellsOpen reference

Platforms

ESXiLinuxmacOSNetwork DevicesWindows

Kill chain phases

persistence

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object