detection.wiki

Server Software Component T1505

Tactic: Persistence

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.

Events covered

26 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
SysmonEvent ID 2A process changed a file creation time
SysmonEvent ID 11FileCreate
SysmonEvent ID 23FileDelete (File Delete archived)
Security-AuditingEvent ID 4688A new process has been created.
Defender-DeviceProcessEventsanyProcess activity
Defender-DeviceProcessEventsProcessCreatedProcess created
ESFcreateFile or Directory Create
ESFrenameFile Rename
Linux-AuditdEvent ID 1300SYSCALL
MSExchange-CmdletLogsEvent ID 1Event ID 1
MSExchange-CmdletLogsEvent ID 6Event ID 6
MSSQLSERVEREvent ID 8128Event ID 8128
MSSQLSERVEREvent ID 15457Event ID 15457
MSSQLSERVEREvent ID 17135Launched startup procedure '%s'.
MSSQLSERVEREvent ID 17199Event ID 17199
MSSQLSERVEREvent ID 17200Event ID 17200
MSSQLSERVEREvent ID 17201Event ID 17201
MSSQLSERVEREvent ID 17202Event ID 17202
MSSQLSERVEREvent ID 17810Event ID 17810
IIS-ConfigurationEvent ID 29Changes to 'Configuration' at 'ConfigPath' have successfully been committed.
IIS-W3SVC-WPEvent ID 2282The Module DLL '%1' could not be loaded due to a configuration problem
PowerShellEvent ID 4103Payload Context: ContextInfo User Data: UserData.
PowerShellEvent ID 4104Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShellEvent ID 800Event ID 800
Sysmon-for-LinuxEvent ID 1Process Create

Authoring guide

These 161 rules share fields, values, and exclusions.

Fields filtered most (91 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
process_basename38in 19, eq 16, wildcard 10, starts_with 5, ends_with 2, regex_match 2bash, cmd.exe, csh, powershell.exe, apache2
CommandLine36contains 24, wildcard 8, regex_match 5, in 3, is_not_null 3, ends_with 1, match 1, starts_with 1* /dev/shm/*, * /run/*, , * /tmp/* , *-classpath *
Image30ends_with 21, eq 6, starts_with 3, wildcard 2, contains 1, is_not_null 1./*, \w3wp.exe, /bin/cat, \cmd.exe, /bin/chmod
EventType28eq 19, in 6, ne 3, wildcard 1exec, creation, deletion, rename, connection_accepted
event.type25eq 23, in 1, ne 1start, change, creation, deletion
TargetFilename24contains 10, ends_with 9, starts_with 5, wildcard 4, in 3, regex_match 3.ashx, .asp, .aspx, *\HttpProxy\OAB\*, *\HttpProxy\owa\auth\*
parent_process_basename22eq 18, in 11, starts_with 8, wildcard 6, ends_with 2*.cgi, *.fcgi, apache2, sqlservr.exe, w3wp.exe
ParentImage17ends_with 10, contains 5, regex_match 2, wildcard 2, eq 1, is_not_null 1, starts_with 1-tomcat-, \caddy.exe, \httpd.exe, \w3wp.exe, /u0*/*
EventID14eq 1415457, 4104, 4688, 1, 17135
ParentCommandLine14contains 11, wildcard 4, starts_with 1*app.py*, *asgi.py*, *django*, *--port*, */app/*.js*
cs-method11eq 10, in 1GET, POST, PUT
file.extension10in 6, eq 4asmx, ashx, ascx, aspx, jsp
process.args10in 9, contains 3, eq 3, wildcard 3, starts_with 2, is_not_null 1, regex_match 1-c, -cl, -lc, *../../../*, *.aws/credentials*
process.parent.args10wildcard 7, contains 3, eq 3, starts_with 2*-Dsolr.solr.home=*, *BitbucketServerLauncher*, *jenkins.war*, *--port*, */app/*.js*
OriginalFileName9eq 7, in 3Cmd.Exe, PowerShell.EXE, powershell_ise.EXE, CertUtil.exe, SeCEdit

Top indicator values (2133 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
171036
EventTypeeq
exec
9547
process_basenamein
bash
8181
process_basenamein
csh
8148
process_basenamein
dash
8150
process_basenamein
fish
8151
process_basenamein
ksh
8149
process_basenamein
sh
8180
process_basenamein
tcsh
8145
process_basenamein
zsh
8180
process_basenamein
busybox
767
ParentCommandLinecontains
*app.py*
77
ParentCommandLinecontains
*asgi.py*
77
ParentCommandLinecontains
*django*
77
ParentCommandLinecontains
*flask*
77
ParentCommandLinecontains
*hypercorn*
77
ParentCommandLinecontains
*passenger*
77
ParentCommandLinecontains
*plackup*
77
ParentCommandLinecontains
*puma*
77
ParentCommandLinecontains
*rails*
77
ParentCommandLinecontains
*server.py*
77
ParentCommandLinecontains
*uvicorn*
77
ParentCommandLinecontains
*wsgi.py*
77
ParentImageends_with
\w3wp.exe
712
process_basenameeq
cmd.exe
7122
process_basenameeq
powershell.exe
7187
cs-methodeq
GET
649
event.categoryeq
process
6105
parent_process_basenameeq
java
611
parent_process_basenamein
apache2
66

Exclusions (675 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
parent_process_basenameeq
apache2
5
parent_process_basenameeq
asterisk
4
parent_process_basenameeq
java
4
parent_process_basenameeq
ruby
4
parent_process_basenameeq
httpd
3
parent_process_basenameeq
nginx
3
parent_process_basenameeq
php-cgi
3
ParentImageeq
/opt/morpheus/embedded/java/jre/bin/java
3
parent_process_basenamestarts_with
php-fpm*
3
CommandLinecontains
*/opt/sc/bin/showvulns*
2
CommandLineeq
/bin/sh -c echo 'Q' | openssl s_client -connect localhost:61617 2>/dev/null...
2
CommandLineeq
/bin/sh -c echo | openssl s_client -connect localhost:61617 2>/dev/null |...
2
CommandLineeq
/bin/sh -c { touch /run/uwsgi-logrotate }
2
CommandLineeq
sh -c /opt/bitnami/php/bin/php -r 'echo phpversion();'
2
CommandLineeq
sh -c /usr/local/bin/php -r 'echo phpversion();'
2

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 61 rules

Elastic 41 rules

Splunk 43 rules

Kusto 11 rules

YARA-L 4 rules

Panther 1 rule