Detect Server Software Component in Elastic Security
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications include features that allow developers to write and install software or scripts to extend the main application's functionality. Adversaries exploit this by installing malicious server software components such as web shells (ASP/ASPX/PHP/JSP files granting remote command execution), SQL stored procedures (particularly xp_cmdshell for OS command execution), IIS native modules or ISAPI filters, Microsoft Exchange transport agents, terminal services DLLs, and vSphere Installation Bundles (VIBs). These components persist across reboots, blend into legitimate server traffic, and provide direct OS-level access under the context of the server process account — making them difficult to detect without proper process lineage monitoring and web root integrity controls.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1505 Server Software Component
- Canonical reference
- https://attack.mitre.org/techniques/T1505/
Elastic Detection Query
sequence by host.name with maxspan=5m
[process where event.type == "start" and
process.parent.name in ("w3wp.exe","httpd.exe","nginx.exe","tomcat9.exe","tomcat.exe","java.exe","php-cgi.exe","perl.exe","python.exe","ruby.exe","node.exe","gunicorn","uvicorn") and
process.name in ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","net.exe","net1.exe","whoami.exe","hostname.exe","ipconfig.exe","systeminfo.exe","nltest.exe","arp.exe","curl.exe","wget.exe","ping.exe","tracert.exe","nslookup.exe","sc.exe")]
[any where true]
OR
any where (
(event.category == "file" and event.type in ("creation","change") and
file.path : ("*\\inetpub\\*","*\\wwwroot\\*","*\\htdocs\\*","*\\webapps\\*","*\\public_html\\*","/var/www/*","/srv/www/*","/usr/share/nginx/*") and
file.extension in ("aspx","asp","php","jsp","jspx","cfm","shtml","ashx","asmx","phtml") and
not process.name in ("msiexec.exe","setup.exe","install.exe","devenv.exe","code.exe","explorer.exe","robocopy.exe","xcopy.exe","w3wp.exe"))
OR
(event.category == "registry" and event.type in ("creation","change") and
registry.path : ("*\\SYSTEM\\CurrentControlSet\\Services\\W3SVC*","*\\SOFTWARE\\Microsoft\\InetStp*","*\\SYSTEM\\CurrentControlSet\\Services\\WAS*") and
registry.data.strings : "*.dll" and
not process.name in ("msiexec.exe","TrustedInstaller.exe","wusa.exe"))
)Detects server software component abuse (T1505) via three complementary signals: (1) web server processes spawning command interpreters or OS recon tools indicating web shell execution, (2) suspicious script files written to web-accessible directories by non-deployment processes, and (3) unauthorized IIS native module or ISAPI filter DLL registration via registry. Covers Windows and Linux web server paths.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate web application deployments via CI/CD pipelines (e.g., Octopus Deploy, Azure DevOps agents) that copy .php or .aspx files to web roots — exclude by deployment agent process names and scheduled deployment windows
- Web server processes (w3wp.exe, java.exe) spawning cmd.exe or powershell.exe for health check scripts or monitoring agents legitimately configured by the operations team
- IIS module registration during legitimate Windows Updates, .NET Framework upgrades, or third-party web application installer packages (msiexec.exe spawning wusa.exe) — already filtered but edge cases exist with custom installers
Other platforms for T1505
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Deploy ASPX Web Shell to IIS Default Web Root
Expected signal: Sysmon Event ID 11: File creation of argus_test_shell.aspx in C:\inetpub\wwwroot\ with Image=powershell.exe. Sysmon Event ID 1: Process Create with ParentImage=w3wp.exe, Image=cmd.exe, CommandLine='/c whoami' when the HTTP request is processed. IIS access log entry: GET request to /argus_test_shell.aspx?cmd=whoami from 127.0.0.1 with status 200. Security Event ID 4688 (if command line auditing enabled) showing cmd.exe with ParentProcessName=w3wp.exe.
- Test 2SQL Server xp_cmdshell OS Command Execution via Stored Procedure
Expected signal: Sysmon Event ID 1: Process Create with ParentImage=sqlservr.exe, Image=cmd.exe, CommandLine='/c whoami /all' and a second instance for 'ipconfig /all'. Security Event ID 4688 (if command line auditing): cmd.exe process creation with parent sqlservr.exe. SQL Server Audit (if enabled): sp_configure modification events and xp_cmdshell execution in the SQL audit log at the configured audit destination. Windows Application Event Log: SQL Server events indicating configuration changes.
- Test 3IIS Native Module Registration via AppCmd
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject containing HKLM\SYSTEM\CurrentControlSet\Services\W3SVC or IIS applicationHost.config path, with Details containing the version.dll path. Sysmon Event ID 1: Process Create for %SystemRoot%\System32\inetsrv\appcmd.exe with CommandLine 'install module /name:ArgusTestModule /image:...'. File Modification: %SystemRoot%\System32\inetsrv\config\applicationHost.config updated to include the new module entry. IIS Event Log: module registration event in Microsoft-Windows-IIS-W3SVC-WP/Operational.
- Test 4PHP Web Shell Deployment on Linux Apache/Nginx
Expected signal: Linux auditd: open/creat syscall creating /var/www/html/argus_test.php. Process creation event: apache2 or php-fpm worker spawning /bin/sh with argument '-c id' (via shell_exec). Apache access log: GET /argus_test.php?cmd=id from 127.0.0.1 with HTTP 200 response. Syslog: process creation by www-data or apache user. If using EDR with Linux support: process creation event with parent=apache2|php-fpm and child=/bin/sh.
- Test 5Simulate Exchange Transport Agent Installation
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Install-TransportAgent'. Windows Registry: modification to HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeTransport with new agent entry. Exchange Application Event Log: transport agent registration events in the MSExchangeTransport source. Sysmon Event ID 11: if the DLL is written to disk first. PowerShell ScriptBlock Logging Event ID 4104: full Install-TransportAgent command with assembly path.
References (9)
- https://attack.mitre.org/techniques/T1505/
- https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/
- https://www.us-cert.gov/ncas/alerts/TA15-314A
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1505.003/T1505.003.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/web
- https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://www.mandiant.com/resources/blog/web-shells-in-the-wild
- https://www.microsoft.com/en-us/security/blog/2021/07/02/microsoft-investigates-iranian-actor-phosphorus-group/
Unlock Pro Content
Get the full detection package for T1505 including response playbook, investigation guide, and atomic red team tests.