Server Software Component (T1505) is a persistence technique. MITRE lists Windows, Linux, macOS, network devices and ESXi as platforms. It covers a simple but uncomfortable fact: many enterprise server applications are built to be extended, and an adversary can use the same extension points.
Web servers, mail servers and database servers often accept modules, plugins, stored code or scripts that developers write and install. If an attacker can install one, their code runs as part of a trusted service, and it comes back every time that service starts.
How attackers use it
MITRE describes the abuse at a high level: adversaries install malicious components that extend and abuse server applications to keep access. The technique has six sub-techniques, each tied to a specific product feature: SQL Stored Procedures, Transport Agent, Web Shell, IIS Components, Terminal Services DLL and vSphere Installation Bundles. This parent entry is the umbrella for the pattern.
What makes this hard to spot is where the code lives. It is inside the application, loaded by a legitimate process, rather than sitting in an obviously strange place.
How to detect it
MITRE's detection strategy lists these behaviors, by platform:
- Installation of malicious IIS, Apache or SQL server modules that later run command line interpreters or make outbound connections.
- Abuse of extensible modules in servers such as Apache, Nginx or Tomcat, where a rogue plugin starts a shell, contacts a command and control server or spawns a reverse shell.
- Malicious web server plugins, for nginx, PHP or Node.js, that run AppleScript or open network sockets on macOS.
- ESXi web interface plugins or vSphere extensions used to embed persistent malicious scripts or services.
A common thread is a server process doing something it never did before, such as launching a shell or opening a new outbound connection.
How to reduce the risk
MITRE lists five mitigations:
- Code Signing: make sure application component binaries are signed by the correct application developers.
- Audit: regularly check component software on critical services to verify integrity and spot unexpected changes.
- Restrict Registry Permissions: use Group Policy to block changes to service and other critical server parameters in the Registry.
- Disable or Remove Feature or Program: turn off software components you do not need.
- Boot Integrity: enable secure boot so software and drivers are validated at startup.
Check your own environment
- Keep an inventory of every module, plugin and extension loaded by each internet facing server.
- Compare that list to a known good baseline on a schedule.
- Alert when a server process starts a shell or script interpreter.
- Disable extension mechanisms that nobody uses.
Quick check
Why is a malicious server component hard to spot?
It runs inside a legitimate server process, so it does not look like a separate unknown program. Behavior changes, such as that process spawning a shell, are the better signal.
