IIS Components (T1505.004) is a persistence technique on Windows. Internet Information Services offers several ways to extend a web server, and MITRE explains how an adversary can install malicious components to keep access.
How attackers use it
IIS supports Internet Server Application Programming Interface (ISAPI) extensions and filters. They are deployed as DLL files that can examine and change incoming and outgoing requests. MITRE notes that these may have access to all IIS web requests and responses.
MITRE says adversaries may install malicious ISAPI extensions and filters to observe or modify traffic, run commands on compromised machines, or proxy command and control traffic. One example is changing HTTP responses to hand malicious commands or content to hosts that were already compromised.
IIS modules, introduced in IIS 7.0, give the same unrestricted access to requests and responses. A module can be a DLL that exports RegisterModule, or a .NET application that uses ASP.NET APIs. Adversaries may use malicious modules to observe or modify traffic as well.
How to detect it
MITRE's analytic describes an adversary installing or changing ISAPI filters, extensions or modules by registering DLL files through configuration changes or administrative tools such as AppCmd.exe. Those components then intercept or manipulate requests and responses.
Useful signals include new DLLs in IIS related folders, changes to IIS configuration files, use of AppCmd.exe outside change windows, and the web server worker process loading DLLs that are not on your baseline.
How to reduce the risk
MITRE lists four mitigations:
- Privileged Account Management: do not use administrator accounts that can add IIS components for daily work.
- Execution Prevention: specify the list of ISAPI extensions and filters that are allowed to run, so unlisted ones are blocked.
- Audit: regularly check installed IIS components for unexpected changes.
- Code Signing: make sure IIS DLLs and binaries are signed by the correct developers.
Check your own environment
This read only command, run on the IIS server, lists the modules IIS is configured to load:
& "$env:windir\system32\inetsrv\appcmd.exe" list modules
Compare the result against a saved baseline. Also check that each custom DLL is signed by a publisher you expect:
Get-AuthenticodeSignature -FilePath C:\path\to\module.dll
Quick check
Why is an IIS module so powerful for an adversary?
Modules get unrestricted access to HTTP requests and responses, the same as ISAPI extensions and filters, so they can observe or change all traffic through the server.
