Compromise Infrastructure: Server (T1584.004) is a resource development technique tagged PRE. The adversary compromises a third party's server and uses it as part of an operation.
The same server could be a web server, an email server, or a plain box in a closet. What matters is that it belongs to someone else.
How attackers use it
MITRE says that using servers lets an adversary stage, launch and execute an operation. After compromise, servers may support command and control. Instead of purchasing a server or a VPS, adversaries compromise third-party servers.
The page gives two specific uses. Compromised web servers can support watering hole operations, as in drive-by compromise. Compromised email servers can support phishing operations.
For the owner, the cost is real even if the target is someone else. Your server may host the payload, send the phishing mail or sit in the chain of command and control.
How to detect it
MITRE says that once adversaries have provisioned software on a compromised server, internet scans may reveal it. It suggests looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with command and control software.
Much of the activity is outside the visibility of the target organization, so detection should focus on related stages such as command and control.
Owner-side signals, as general practice:
- For web servers, changes to files or scripts that nobody deployed, and pages that serve different content to different visitors.
- For email servers, outbound mail volume that jumps, or messages sent from accounts that were idle.
- For any server, unexpected listening ports and unfamiliar outbound connections.
- File integrity monitoring on web roots, with alerts routed to a person.
How to reduce the risk
MITRE lists Pre-compromise as the mitigation, with no easy preventive control from the target side.
These owner-side steps are general practice.
- Patch internet-facing servers on a fixed schedule, and remove software you do not use.
- Restrict administrative access to known networks and require strong authentication.
- Monitor the web root and mail queues for changes you did not expect.
- Keep clean backups and a rebuild procedure, so that recovery means reimaging, not hoping.
- Publish a security contact so that outsiders can tell you when your server is behaving badly.
One more practice is worth mentioning. Keep a tested rebuild path for each exposed server. If a server may be compromised, the safest response is to rebuild from a known good image and restore data, not to clean in place. Teams that practice the rebuild once a year find that it is faster than they feared, and they make the decision with less hesitation when it matters.
Check your own environment
- Linux, read-only:
ss -tlnpshows listening services. Compare with the documented list. - Linux, read-only:
find /var/www -type f -mtime -7lists web files changed in the last week (adjust the path to your web root). - Mail servers: check the queue and the outbound volume graph for the last 30 days.
- Do you have a security.txt file or a monitored security mailbox?
Quick check
What two follow-on uses of compromised servers does MITRE name?
Compromised web servers for watering hole operations, and compromised email servers for phishing.
How can internet scans help?
They may reveal servers running adversary command and control software, through listening services, certificates and TLS negotiation features.
