ATT&CK Reference
Portfolio

TA0003 · PERSISTENCE

Server Software Component

T1505Windows · Linux · macOS · Network Devices · ESXiattack.mitre.org

Web shells, IIS modules, and SQL stored procedures planted inside legitimate server software.

Detect it with

New .aspx/.php files in web roots; web server processes spawning shells; file integrity monitoring on web directories.

Why it matters on shift

Server Software Component is one of the concrete ways adversaries achieve persistence. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.

What to look for next

After persistence, the next tactic is usually Privilege Escalation. Search your telemetry for the transition before closing the ticket.

6 sub-techniques

How it shows up in practice

  1. T1505.001

    SQL Stored Procedures

    Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries.

  2. T1505.002

    Transport Agent

    Adversaries may abuse Microsoft transport agents to establish persistent access to systems.

  3. T1505.003

    Web Shell

    Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network.

  4. T1505.004

    IIS Components

    Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers.

  5. T1505.005

    Terminal Services DLL

    Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts.

  6. T1505.006

    vSphere Installation Bundles

    Adversaries may abuse vSphere Installation Bundles (VIBs) to establish persistent access to ESXi hypervisors. VIBs are collections of files used for software distribution and virtual system management in VMware environments.

Kill-chain context

← beforeExecutionPersistenceafter →Privilege Escalation