Detect Server Software Component in Google Chronicle
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications include features that allow developers to write and install software or scripts to extend the main application's functionality. Adversaries exploit this by installing malicious server software components such as web shells (ASP/ASPX/PHP/JSP files granting remote command execution), SQL stored procedures (particularly xp_cmdshell for OS command execution), IIS native modules or ISAPI filters, Microsoft Exchange transport agents, terminal services DLLs, and vSphere Installation Bundles (VIBs). These components persist across reboots, blend into legitimate server traffic, and provide direct OS-level access under the context of the server process account — making them difficult to detect without proper process lineage monitoring and web root integrity controls.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1505 Server Software Component
- Canonical reference
- https://attack.mitre.org/techniques/T1505/
YARA-L Detection Query
rule t1505_server_software_component {
meta:
author = "df00tech"
description = "Detects T1505 Server Software Component abuse via web shell child process execution, suspicious web file creation in web roots, or unauthorized IIS module DLL registration via registry"
mitre_attack_tactic = "Persistence"
mitre_attack_technique = "T1505"
mitre_attack_url = "https://attack.mitre.org/techniques/T1505/"
severity = "HIGH"
priority = "HIGH"
events:
// Signal 1: Web server spawning suspicious child processes (web shell execution)
(
$e1.metadata.event_type = "PROCESS_LAUNCH"
and (
$e1.principal.process.file.full_path = /(?i)(w3wp\.exe|httpd\.exe|nginx\.exe|tomcat[0-9]*\.exe|java\.exe|php-cgi\.exe|perl\.exe|python\.exe|ruby\.exe|node\.exe|gunicorn|uvicorn)$/
)
and (
$e1.target.process.file.full_path = /(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|net\.exe|net1\.exe|whoami\.exe|hostname\.exe|ipconfig\.exe|systeminfo\.exe|nltest\.exe|arp\.exe|curl\.exe|wget\.exe|ping\.exe|tracert\.exe|nslookup\.exe|sc\.exe)$/
)
)
or
// Signal 2: Suspicious web shell file written to web-accessible directories
(
$e1.metadata.event_type = "FILE_CREATION"
and (
$e1.target.file.full_path = /(?i)(\\inetpub\\|\\wwwroot\\|\\htdocs\\|\\webapps\\|\\public_html\\|\/var\/www\/|\/srv\/www\/|\/usr\/share\/nginx/)/
)
and (
$e1.target.file.full_path = /(?i)\.(aspx|asp|php|jsp|jspx|cfm|shtml|ashx|asmx|phtml)$/
)
and not (
$e1.principal.process.file.full_path = /(?i)(msiexec\.exe|setup\.exe|install\.exe|devenv\.exe|code\.exe|explorer\.exe|robocopy\.exe|xcopy\.exe|w3wp\.exe)$/
)
)
or
// Signal 3: IIS native module or ISAPI filter DLL registered via registry
(
$e1.metadata.event_type = "REGISTRY_MODIFICATION"
and (
$e1.target.registry.registry_key = /(?i)(SYSTEM\\CurrentControlSet\\Services\\W3SVC|SOFTWARE\\Microsoft\\InetStp|SYSTEM\\CurrentControlSet\\Services\\WAS)/
)
and $e1.target.registry.registry_value_data = /(?i)\.dll/
and not (
$e1.principal.process.file.full_path = /(?i)(msiexec\.exe|TrustedInstaller\.exe|wusa\.exe)$/
)
)
condition:
$e1
}Chronicle YARA-L 2.0 detection rule for T1505 Server Software Component covering three detection signals: web server process spawning command interpreters or OS recon tools (web shell execution indicator), suspicious script file creation in web-accessible directories by non-deployment processes, and unauthorized IIS native module or ISAPI DLL registration via registry. Uses UDM process, file, and registry event types.
Data Sources
Required Tables
False Positives & Tuning
- Java application servers (Tomcat, JBoss, WebSphere) that legitimately spawn java.exe child processes for background job execution, JVM monitoring agents, or JMX remote management — exclude by verifying child process command-line arguments reference known application class names
- Web content management system (CMS) plugins or modules (WordPress, Drupal, Joomla) that write .php files to web directories during plugin installations performed by the web server process itself — add w3wp.exe or apache.exe to Signal 2 exclusions for known CMS directories
- IIS URL Rewrite Module, ARR (Application Request Routing), or other legitimate Microsoft IIS extensions that modify W3SVC registry keys during initial setup or version upgrades via custom installer binaries not matching standard exclusion patterns
Other platforms for T1505
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Deploy ASPX Web Shell to IIS Default Web Root
Expected signal: Sysmon Event ID 11: File creation of argus_test_shell.aspx in C:\inetpub\wwwroot\ with Image=powershell.exe. Sysmon Event ID 1: Process Create with ParentImage=w3wp.exe, Image=cmd.exe, CommandLine='/c whoami' when the HTTP request is processed. IIS access log entry: GET request to /argus_test_shell.aspx?cmd=whoami from 127.0.0.1 with status 200. Security Event ID 4688 (if command line auditing enabled) showing cmd.exe with ParentProcessName=w3wp.exe.
- Test 2SQL Server xp_cmdshell OS Command Execution via Stored Procedure
Expected signal: Sysmon Event ID 1: Process Create with ParentImage=sqlservr.exe, Image=cmd.exe, CommandLine='/c whoami /all' and a second instance for 'ipconfig /all'. Security Event ID 4688 (if command line auditing): cmd.exe process creation with parent sqlservr.exe. SQL Server Audit (if enabled): sp_configure modification events and xp_cmdshell execution in the SQL audit log at the configured audit destination. Windows Application Event Log: SQL Server events indicating configuration changes.
- Test 3IIS Native Module Registration via AppCmd
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject containing HKLM\SYSTEM\CurrentControlSet\Services\W3SVC or IIS applicationHost.config path, with Details containing the version.dll path. Sysmon Event ID 1: Process Create for %SystemRoot%\System32\inetsrv\appcmd.exe with CommandLine 'install module /name:ArgusTestModule /image:...'. File Modification: %SystemRoot%\System32\inetsrv\config\applicationHost.config updated to include the new module entry. IIS Event Log: module registration event in Microsoft-Windows-IIS-W3SVC-WP/Operational.
- Test 4PHP Web Shell Deployment on Linux Apache/Nginx
Expected signal: Linux auditd: open/creat syscall creating /var/www/html/argus_test.php. Process creation event: apache2 or php-fpm worker spawning /bin/sh with argument '-c id' (via shell_exec). Apache access log: GET /argus_test.php?cmd=id from 127.0.0.1 with HTTP 200 response. Syslog: process creation by www-data or apache user. If using EDR with Linux support: process creation event with parent=apache2|php-fpm and child=/bin/sh.
- Test 5Simulate Exchange Transport Agent Installation
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Install-TransportAgent'. Windows Registry: modification to HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeTransport with new agent entry. Exchange Application Event Log: transport agent registration events in the MSExchangeTransport source. Sysmon Event ID 11: if the DLL is written to disk first. PowerShell ScriptBlock Logging Event ID 4104: full Install-TransportAgent command with assembly path.
References (9)
- https://attack.mitre.org/techniques/T1505/
- https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/
- https://www.us-cert.gov/ncas/alerts/TA15-314A
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1505.003/T1505.003.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/web
- https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://www.mandiant.com/resources/blog/web-shells-in-the-wild
- https://www.microsoft.com/en-us/security/blog/2021/07/02/microsoft-investigates-iranian-actor-phosphorus-group/
Unlock Pro Content
Get the full detection package for T1505 including response playbook, investigation guide, and atomic red team tests.