Server Software Component T1505

Tactic: Persistence

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.

Events covered

22 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 144 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (101 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
CommandLine30contains 21, in 3, is_not_null 3, wildcard 2, ends_with 1, match 1, regex_match 1, starts_with 1-classpath , .payload, module, msexchange, -af
Image28ends_with 21, eq 4, contains 1, is_not_null 1, starts_with 1, wildcard 1\cmd.exe, \w3wp.exe, \appcmd.exe, \bash.exe, \powershell.exe
process_name28eq 13, in 9, match 4, starts_with 4, wildcard 3cmd.exe, powershell.exe, bash, busybox, csh
TargetFilename21ends_with 9, contains 8, in 3, regex_match 3, starts_with 3, wildcard 2.ashx, .asp, .aspx, *\\httpproxy\\oab\\*, *\\httpproxy\\owa\\auth\\*
EventType20eq 15, in 4, wildcard 1exec, creation, AssociateAgentCollaborator, AssociateAgentKnowledgeBase, CreateAgent
event.type20eq 19, ne 1start, change, creation, deletion
parent_process_name19eq 14, in 8, starts_with 7, wildcard 3, ends_with 2, match 2apache2, *.cgi, *.fcgi, (?i)sqlservr\.exe, .cgi
ParentImage15ends_with 10, contains 4, regex_match 2, wildcard 2, eq 1, starts_with 1-tomcat-, \caddy.exe, \httpd.exe, \w3wp.exe, /u0*/*
EventID14eq 1415457, 4104, 4688, 1, 17135
host.os.type13eq 11, in 2
cs-method11eq 10, in 1GET, POST, PUT
ParentCommandLine10contains 7, ne 1, starts_with 1, wildcard 1app.py, asgi.py, django, */sap.com*/servlet_jsp/irj/*, *\sap.com*\servlet_jsp\irj\*
OriginalFileName9eq 7, in 3cmd.exe, powershell.exe, powershell_ise.exe, appcmd.exe, bitsadmin.exe
cs-uri-query8contains 7, starts_with 1, wildcard 1%2fdev%2ftcp, %2fetc%2fpasswd, %comspec%, &dwn=, &fn=
EventData7contains 7.dll, enable-transportagent, install-transportagent, -image, <data>clr enabled</data><data>0</data><data>1</data>

Top indicator values (1572 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
18606
EventTypeeq
exec
7171
ParentImageends_with
\w3wp.exe
712
parent_process_nameeq
java
78
cs-methodeq
GET
649
event.categoryeq
process
6128
process_nameeq
cmd.exe
677
process_nameeq
powershell.exe
6104
process_nameeq
powershell_ise.exe
650
process_nameeq
pwsh.exe
662
Imageends_with
\cmd.exe
5130
Imageends_with
\powershell.exe
5182
Imageends_with
\w3wp.exe
56
parent_process_namein
apache2
56
parent_process_namein
caddy
56
parent_process_namein
daphne
55
parent_process_namein
flask
55
parent_process_namein
httpd
56
parent_process_namein
httpd.worker
55
parent_process_namein
lswsctrl
55
parent_process_namein
mongrel_rails
55
parent_process_namein
nginx
56
parent_process_namein
php-cgi
55
parent_process_namein
php-cgi.cagefs
55
parent_process_namein
php-fcgi
55
parent_process_namein
uwsgi
55
parent_process_namestarts_with
perl
55
parent_process_namestarts_with
python
512
parent_process_namestarts_with
ruby
55
process_namein
bash
588

Exclusions (341 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
parent_process_nameeq
java
3
parent_process_nameeq
apache2
2
parent_process_nameeq
nginx
2
parent_process_nameeq
php-cgi
2
CommandLinecontains
/opt/sc/bin/showvulns
2
CurrentDirectoryeq
/
2
CurrentDirectorystarts_with
/home/
2
CurrentDirectorywildcard
/u0*/*/sysman/emd
2
CurrentDirectorywildcard
/u0*/app/oracle/product/*/db_*
2
CurrentDirectorywildcard
/u0*/app/oracle/product/*/dbhome_*
2
CurrentDirectorywildcard
/var/www/*edoc*
2
ParentImagestarts_with
/vscode/vscode-server/
2
parent_process_namein
iissetup.exe
2
parent_process_namein
msiexec.exe
2
parent_process_namestarts_with
php-fpm
2

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 56 rules

Elastic 30 rules

Splunk 42 rules

Kusto 11 rules

YARA-L 4 rules

Panther 1 rule