Detect Server Software Component in CrowdStrike LogScale
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications include features that allow developers to write and install software or scripts to extend the main application's functionality. Adversaries exploit this by installing malicious server software components such as web shells (ASP/ASPX/PHP/JSP files granting remote command execution), SQL stored procedures (particularly xp_cmdshell for OS command execution), IIS native modules or ISAPI filters, Microsoft Exchange transport agents, terminal services DLLs, and vSphere Installation Bundles (VIBs). These components persist across reboots, blend into legitimate server traffic, and provide direct OS-level access under the context of the server process account — making them difficult to detect without proper process lineage monitoring and web root integrity controls.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1505 Server Software Component
- Canonical reference
- https://attack.mitre.org/techniques/T1505/
LogScale Detection Query
// Signal 1: Web server spawning suspicious child processes (web shell execution)
(
#event_simpleName = "ProcessRollup2"
| ParentBaseFileName = /(?i)^(w3wp|httpd|nginx|tomcat[0-9]*|java|php-cgi|perl|python[0-9.]*|ruby|node|gunicorn|uvicorn)\.exe$/i
| FileName = /(?i)^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|net|net1|whoami|hostname|ipconfig|systeminfo|nltest|arp|curl|wget|ping|tracert|nslookup|sc)\.exe$/i
| DetectionType := "WebShell_ChildProcess"
| SeverityRating := if(FileName = /(?i)^(cmd|powershell|pwsh|wscript|cscript|mshta)\.exe$/, "Critical", "High")
)
UNION
// Signal 2: Web shell file written to web-accessible directories
(
#event_simpleName = "NewExecutableWritten"
OR #event_simpleName = "NewScriptWritten"
OR #event_simpleName = "PeFileWritten"
| TargetFileName = /(?i)(\\inetpub\\|\\wwwroot\\|\\htdocs\\|\\webapps\\|\\public_html\\|\/var\/www\/|\/srv\/www\/|\/usr\/share\/nginx/)/
| TargetFileName = /(?i)\.(aspx|asp|php|jsp|jspx|cfm|shtml|ashx|asmx|phtml)$/
| not(FileName = /(?i)^(msiexec|setup|install|devenv|code|explorer|robocopy|xcopy|w3wp)\.exe$/)
| DetectionType := "SuspiciousWebFile_Written"
| SeverityRating := "High"
)
UNION
// Signal 3: IIS module DLL registered via registry modification
(
#event_simpleName = "RegGenericValueUpdate"
OR #event_simpleName = "RegKeyCreate"
| RegObjectName = /(?i)(SYSTEM\\CurrentControlSet\\Services\\W3SVC|SOFTWARE\\Microsoft\\InetStp|SYSTEM\\CurrentControlSet\\Services\\WAS)/
| RegStringValue = /(?i)\.dll$/
| not(FileName = /(?i)^(msiexec|TrustedInstaller|wusa)\.exe$/)
| DetectionType := "IIS_Module_Registered"
| SeverityRating := "High"
)
| groupBy([ComputerName, FileName, CommandLine, ParentBaseFileName, TargetFileName, RegObjectName, RegStringValue, DetectionType, SeverityRating], function=count(aid, as=EventCount))
| sort(SeverityRating, order=desc)CrowdStrike LogScale (Humio) CQL detection for T1505 Server Software Component using three Falcon telemetry signals: ProcessRollup2 events identifying web server processes spawning suspicious child processes (web shell command execution), file write events (NewExecutableWritten/NewScriptWritten) capturing web shell drops in web-accessible directories, and registry modification events (RegGenericValueUpdate/RegKeyCreate) detecting unauthorized IIS module DLL registration. Results grouped by host and detection context.
Data Sources
Required Tables
False Positives & Tuning
- Python or Node.js processes used by development tooling (Jupyter notebooks, VS Code extensions, npm scripts) on developer workstations that are also running lightweight local web servers — scope alerts to production server asset groups using ComputerName patterns or GroupingTags
- Java-based application monitoring agents (Dynatrace OneAgent, AppDynamics, New Relic) that inject into java.exe processes and may appear as child process spawns under web server parents — whitelist known APM agent binary paths in the FileName exclusion logic
- Legitimate web application self-update mechanisms or content publishing workflows (Sitecore, Umbraco, SharePoint) that write .aspx or .ashx files to IIS web roots using the application pool identity process (w3wp.exe) — add w3wp.exe to Signal 2 process exclusions with path-scoped exceptions for known CMS update directories
Other platforms for T1505
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Deploy ASPX Web Shell to IIS Default Web Root
Expected signal: Sysmon Event ID 11: File creation of argus_test_shell.aspx in C:\inetpub\wwwroot\ with Image=powershell.exe. Sysmon Event ID 1: Process Create with ParentImage=w3wp.exe, Image=cmd.exe, CommandLine='/c whoami' when the HTTP request is processed. IIS access log entry: GET request to /argus_test_shell.aspx?cmd=whoami from 127.0.0.1 with status 200. Security Event ID 4688 (if command line auditing enabled) showing cmd.exe with ParentProcessName=w3wp.exe.
- Test 2SQL Server xp_cmdshell OS Command Execution via Stored Procedure
Expected signal: Sysmon Event ID 1: Process Create with ParentImage=sqlservr.exe, Image=cmd.exe, CommandLine='/c whoami /all' and a second instance for 'ipconfig /all'. Security Event ID 4688 (if command line auditing): cmd.exe process creation with parent sqlservr.exe. SQL Server Audit (if enabled): sp_configure modification events and xp_cmdshell execution in the SQL audit log at the configured audit destination. Windows Application Event Log: SQL Server events indicating configuration changes.
- Test 3IIS Native Module Registration via AppCmd
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject containing HKLM\SYSTEM\CurrentControlSet\Services\W3SVC or IIS applicationHost.config path, with Details containing the version.dll path. Sysmon Event ID 1: Process Create for %SystemRoot%\System32\inetsrv\appcmd.exe with CommandLine 'install module /name:ArgusTestModule /image:...'. File Modification: %SystemRoot%\System32\inetsrv\config\applicationHost.config updated to include the new module entry. IIS Event Log: module registration event in Microsoft-Windows-IIS-W3SVC-WP/Operational.
- Test 4PHP Web Shell Deployment on Linux Apache/Nginx
Expected signal: Linux auditd: open/creat syscall creating /var/www/html/argus_test.php. Process creation event: apache2 or php-fpm worker spawning /bin/sh with argument '-c id' (via shell_exec). Apache access log: GET /argus_test.php?cmd=id from 127.0.0.1 with HTTP 200 response. Syslog: process creation by www-data or apache user. If using EDR with Linux support: process creation event with parent=apache2|php-fpm and child=/bin/sh.
- Test 5Simulate Exchange Transport Agent Installation
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Install-TransportAgent'. Windows Registry: modification to HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeTransport with new agent entry. Exchange Application Event Log: transport agent registration events in the MSExchangeTransport source. Sysmon Event ID 11: if the DLL is written to disk first. PowerShell ScriptBlock Logging Event ID 4104: full Install-TransportAgent command with assembly path.
References (9)
- https://attack.mitre.org/techniques/T1505/
- https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/
- https://www.us-cert.gov/ncas/alerts/TA15-314A
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1505.003/T1505.003.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/web
- https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://www.mandiant.com/resources/blog/web-shells-in-the-wild
- https://www.microsoft.com/en-us/security/blog/2021/07/02/microsoft-investigates-iranian-actor-phosphorus-group/
Unlock Pro Content
Get the full detection package for T1505 including response playbook, investigation guide, and atomic red team tests.