Which SIEM platforms have a T1505 detection rule?

df00tech provides T1505 (Server Software Component) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the T1505 detection?

The T1505 detection is rated critical severity with high confidence.

What are common false positives for T1505?

Common false positives for T1505 include: Java application servers (Tomcat, JBoss, WebLogic) spawning java.exe child processes for legitimate scheduled tasks, diagnostics, or maintenance operations initiated through management interfaces; CI/CD pipeline agents deployed on web servers that legitimately invoke cmd.exe or PowerShell during automated build and deployment workflows — typically identifiable by consistent command line patterns and timing aligned with deployment schedules; Content management systems (WordPress, Drupal, Joomla) executing PHP scripts that invoke system utilities for image processing, PDF generation, or file archiving via exec() or shell_exec().

T1505 Splunk · SPL

Detect Server Software Component in Splunk

Q: What data sources are required to detect Server Software Component (T1505)?

Detecting Server Software Component requires the following data sources: Process: Process Creation, File: File Creation, Windows Registry: Windows Registry Key Modification, Microsoft Defender for Endpoint.

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications include features that allow developers to write and install software or scripts to extend the main application's functionality. Adversaries exploit this by installing malicious server software components such as web shells (ASP/ASPX/PHP/JSP files granting remote command execution), SQL stored procedures (particularly xp_cmdshell for OS command execution), IIS native modules or ISAPI filters, Microsoft Exchange transport agents, terminal services DLLs, and vSphere Installation Bundles (VIBs). These components persist across reboots, blend into legitimate server traffic, and provide direct OS-level access under the context of the server process account — making them difficult to detect without proper process lineage monitoring and web root integrity controls.

MITRE ATT&CK

Tactic: Persistence
Technique: T1505 Server Software Component
Canonical reference: https://attack.mitre.org/techniques/T1505/

SPL Detection Query

Splunk (SPL)

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(
  (
    EventCode=1
    (
      ParentImage="*\\w3wp.exe" OR ParentImage="*\\httpd.exe" OR ParentImage="*\\nginx.exe"
      OR ParentImage="*\\tomcat*.exe" OR ParentImage="*\\java.exe" OR ParentImage="*\\php-cgi.exe"
      OR ParentImage="*\\perl.exe" OR ParentImage="*\\python.exe" OR ParentImage="*\\ruby.exe"
      OR ParentImage="*\\node.exe"
    )
    (
      Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe"
      OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe"
      OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe"
      OR Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\whoami.exe"
      OR Image="*\\systeminfo.exe" OR Image="*\\ipconfig.exe" OR Image="*\\hostname.exe"
      OR Image="*\\nltest.exe" OR Image="*\\curl.exe" OR Image="*\\wget.exe"
    )
  )
  OR
  (
    EventCode=11
    (
      TargetFilename="*\\inetpub\\*" OR TargetFilename="*\\wwwroot\\*"
      OR TargetFilename="*\\htdocs\\*" OR TargetFilename="*\\webapps\\*"
      OR TargetFilename="*\\public_html\\*" OR TargetFilename="*/var/www/*"
    )
    (
      TargetFilename="*.aspx" OR TargetFilename="*.asp" OR TargetFilename="*.php"
      OR TargetFilename="*.jsp" OR TargetFilename="*.jspx" OR TargetFilename="*.cfm"
      OR TargetFilename="*.ashx" OR TargetFilename="*.asmx" OR TargetFilename="*.phtml"
    )
    NOT (
      Image="*\\msiexec.exe" OR Image="*\\setup.exe" OR Image="*\\devenv.exe"
      OR Image="*\\code.exe" OR Image="*\\explorer.exe" OR Image="*\\robocopy.exe"
    )
  )
  OR
  (
    EventCode=13
    (
      TargetObject="*\\CurrentControlSet\\Services\\W3SVC*"
      OR TargetObject="*\\SOFTWARE\\Microsoft\\InetStp*"
      OR TargetObject="*\\CurrentControlSet\\Services\\WAS*"
    )
    Details="*.dll"
    NOT (Image="*\\msiexec.exe" OR Image="*\\TrustedInstaller.exe" OR Image="*\\wusa.exe")
  )
)
| eval DetectionType=case(
    EventCode=1, "WebShell_ChildProcess",
    EventCode=11, "SuspiciousWebFile_Written",
    EventCode=13, "IIS_Module_Registered",
    true(), "Unknown"
  )
| eval SeverityRating=case(
    EventCode=1 AND match(Image, "(?i)(cmd|powershell|pwsh|wscript|cscript|mshta)\.exe"), "Critical",
    EventCode=1, "High",
    EventCode=11, "High",
    EventCode=13, "High",
    true(), "Medium"
  )
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, TargetFilename, TargetObject, Details, DetectionType, SeverityRating
| sort - _time

critical severity high confidence

Multi-signal Sysmon detection for Server Software Component abuse covering web shell execution, file deployment, and IIS module registration. EventCode=1 (Process Create) identifies web server processes spawning command interpreters or recon tools — the definitive web shell execution signal. EventCode=11 (File Create) catches script files written to web roots by unexpected processes, detecting the web shell drop phase. EventCode=13 (Registry Value Set) flags unauthorized DLL registration in IIS W3SVC service keys, covering T1505.004 IIS Component persistence. All three signals feed a unified results table with severity classification to guide analyst triage.

Data Sources

Process: Process CreationFile: File CreationWindows Registry: Windows Registry Key ModificationSysmon Event ID 1Sysmon Event ID 11Sysmon Event ID 13

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives & Tuning

Java application servers spawning legitimate child java.exe processes for internal maintenance, garbage collection triggers, or management interface operations
CI/CD deployment agents running on web servers that legitimately invoke cmd.exe or PowerShell during automated deployment pipelines — identifiable by consistent command patterns aligned with deployment windows
CMS platforms (WordPress via PHP, Drupal) invoking system utilities for media processing or plugin operations through exec() or shell_exec() system calls
Web-based server administration panels (cPanel, Plesk, Webmin) that by design execute OS commands through web server worker processes as part of their administration functionality
Development environments where IIS is installed locally and IDEs or deployment scripts write files to wwwroot during development workflows
Legitimate IIS module installations by authorized administrators using msiexec.exe or TrustedInstaller — these are excluded by the NOT clause but verify the DLL path is from an approved vendor

Download portable Sigma rule (.yml)

Other platforms for T1505

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Deploy ASPX Web Shell to IIS Default Web Root
Expected signal: Sysmon Event ID 11: File creation of argus_test_shell.aspx in C:\inetpub\wwwroot\ with Image=powershell.exe. Sysmon Event ID 1: Process Create with ParentImage=w3wp.exe, Image=cmd.exe, CommandLine='/c whoami' when the HTTP request is processed. IIS access log entry: GET request to /argus_test_shell.aspx?cmd=whoami from 127.0.0.1 with status 200. Security Event ID 4688 (if command line auditing enabled) showing cmd.exe with ParentProcessName=w3wp.exe.
Test 2SQL Server xp_cmdshell OS Command Execution via Stored Procedure
Expected signal: Sysmon Event ID 1: Process Create with ParentImage=sqlservr.exe, Image=cmd.exe, CommandLine='/c whoami /all' and a second instance for 'ipconfig /all'. Security Event ID 4688 (if command line auditing): cmd.exe process creation with parent sqlservr.exe. SQL Server Audit (if enabled): sp_configure modification events and xp_cmdshell execution in the SQL audit log at the configured audit destination. Windows Application Event Log: SQL Server events indicating configuration changes.
Test 3IIS Native Module Registration via AppCmd
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject containing HKLM\SYSTEM\CurrentControlSet\Services\W3SVC or IIS applicationHost.config path, with Details containing the version.dll path. Sysmon Event ID 1: Process Create for %SystemRoot%\System32\inetsrv\appcmd.exe with CommandLine 'install module /name:ArgusTestModule /image:...'. File Modification: %SystemRoot%\System32\inetsrv\config\applicationHost.config updated to include the new module entry. IIS Event Log: module registration event in Microsoft-Windows-IIS-W3SVC-WP/Operational.
Test 4PHP Web Shell Deployment on Linux Apache/Nginx
Expected signal: Linux auditd: open/creat syscall creating /var/www/html/argus_test.php. Process creation event: apache2 or php-fpm worker spawning /bin/sh with argument '-c id' (via shell_exec). Apache access log: GET /argus_test.php?cmd=id from 127.0.0.1 with HTTP 200 response. Syslog: process creation by www-data or apache user. If using EDR with Linux support: process creation event with parent=apache2|php-fpm and child=/bin/sh.
Test 5Simulate Exchange Transport Agent Installation
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Install-TransportAgent'. Windows Registry: modification to HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeTransport with new agent entry. Exchange Application Event Log: transport agent registration events in the MSExchangeTransport source. Sysmon Event ID 11: if the DLL is written to disk first. PowerShell ScriptBlock Logging Event ID 4104: full Install-TransportAgent command with assembly path.

Last updated: 2026-04-20 Research depth: deep

References (9)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1505 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Server Software Component in Splunk

MITRE ATT&CK

SPL Detection Query

Data Sources

Required Sourcetypes

False Positives & Tuning

Other platforms for T1505

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (6)

Related Techniques

Same Tactic: Persistence

Popular Detections

MITRE ATT&CK

SPL Detection Query

Data Sources

Required Sourcetypes

False Positives & Tuning

Other platforms for T1505

Testing Methodology

Unlock Pro Content

Related Detections

Sub-techniques (6)

Related Techniques

Same Tactic: Persistence

Popular Detections

Get new detections in your inbox