EXPLORE
← Back to Explore
T1505

Server Software Component

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)

WindowsLinuxmacOSNetwork DevicesESXi
25
Detections
4
Sources
0
Threat Actors

BY SOURCE

21elastic2splunk_escu1kql1sigma

PROCEDURES (19)

Suspicious3 detections

Auto-extracted: 3 detections for suspicious

Parent Process3 detections

Auto-extracted: 3 detections for parent process

Service2 detections

Auto-extracted: 2 detections for service

Http2 detections

Auto-extracted: 2 detections for http

Remote1 detections

Auto-extracted: 1 detections for remote

Service1 detections

Auto-extracted: 1 detections for service

Privilege1 detections

Auto-extracted: 1 detections for privilege

Command Line Monitoring1 detections

Auto-extracted: 1 detections for command line monitoring

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Privilege1 detections

Auto-extracted: 1 detections for privilege

Persist1 detections

Auto-extracted: 1 detections for persist

Unusual1 detections

Auto-extracted: 1 detections for unusual

Privilege1 detections

Auto-extracted: 1 detections for privilege

Persist1 detections

Auto-extracted: 1 detections for persist

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Remote1 detections

Auto-extracted: 1 detections for remote

Process Creation Monitoring1 detections

Auto-extracted: 1 detections for process creation monitoring

Remote1 detections

Auto-extracted: 1 detections for remote

Http1 detections

Auto-extracted: 1 detections for http

DETECTIONS (25)