{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1505","id":"T1505","name":"Server Software Component","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1505","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"e7efc11e020ea83ffb80b41801f96781325b143ffce19b0ea8e9d4c5f3b9aa8b","description":"Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1505","external_id":"T1505"},{"source_name":"volexity_0day_sophos_FW","description":"Adair, S., Lancaster, T., Volexity Threat Research. (2022, June 15). DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach. Retrieved July 1, 2022.","url":"https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/"},{"source_name":"US-CERT Alert TA15-314A Web Shells","description":"US-CERT. (2015, November 13). Compromised Web Servers and Web Shells - Threat Awareness and Guidance. Retrieved June 8, 2016.","url":"https://www.us-cert.gov/ncas/alerts/TA15-314A"}],"platforms":["Windows","Linux","macOS","Network Devices","ESXi"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1505.001","id":"T1505.001","name":"SQL Stored Procedures","page":"techniques/enterprise/T1505.001/"},{"key":"enterprise/T1505.002","id":"T1505.002","name":"Transport Agent","page":"techniques/enterprise/T1505.002/"},{"key":"enterprise/T1505.003","id":"T1505.003","name":"Web Shell","page":"techniques/enterprise/T1505.003/"},{"key":"enterprise/T1505.004","id":"T1505.004","name":"IIS Components","page":"techniques/enterprise/T1505.004/"},{"key":"enterprise/T1505.005","id":"T1505.005","name":"Terminal Services DLL","page":"techniques/enterprise/T1505.005/"},{"key":"enterprise/T1505.006","id":"T1505.006","name":"vSphere Installation Bundles","page":"techniques/enterprise/T1505.006/"}],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0001","name":"Scheduled Job Creation","page":"telemetry/DC0001/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a scheduled execution object, including its trigger, principal and executable action.","collection_focus":"Enable Audit Other Object Access Events for Windows task creation (4698); retain task XML. For cron/systemd timers, collect scheduler definitions and change events separately.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["task_name","action","principal","schedule","program"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0001","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","action":"create","principal":"lab-user","schedule":"daily","program":"lab-check.exe"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."}],"detection":{"key":"enterprise/T1505","id":"T1505","name":"Server Software Component","domain":"enterprise","platforms":["Windows","Linux","macOS","Network Devices","ESXi"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1505","technique_page":"techniques/enterprise/T1505/","page":"detections/enterprise/T1505/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"671ffc77-50a7-464f-9e3d-9ea2b493b26b","title":"Cisco Modify Configuration","status":"test","level":"medium","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/671ffc77-50a7-464f-9e3d-9ea2b493b26b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_modify_config.yml","author":"Austin Clark","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0547","name":"Detection Strategy for T1505 - Server Software Component","url":"https://attack.mitre.org/detectionstrategies/DET0547","stix_id":"x-mitre-detection-strategy--27b606f9-dde4-456c-8d90-51289313994f","relationship_id":"relationship--18790331-6ac1-4274-b7ef-129b7c4b1c7c","description":"","analytics":[{"id":"AN1507","name":"Analytic 1507","guidance":"Installation of malicious IIS/Apache/SQL server modules that later execute command-line interpreters or establish outbound connections.","url":"https://attack.mitre.org/detectionstrategies/DET0547#AN1507","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Time delta between module install and process execution (e.g., persistence delay)."},{"field":"ParentProcessName","description":"Custom server wrapper processes or renamed webserver processes may require tuning."}],"log_sources":[{"component_id":"DC0001","component":"Scheduled Job Creation","name":"WinEventLog:Security","channel":"EventCode=4698","platforms":["Windows"],"analytic_id":"AN1507","source_url":"https://attack.mitre.org/detectionstrategies/DET0547#AN1507","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0001/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1507","source_url":"https://attack.mitre.org/detectionstrategies/DET0547#AN1507","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0038","component":"Application Log Content","name":"WinEventLog:Application","channel":"Unusual DLL/plugin registration for IIS/SQL/Apache or unexpected error logs","platforms":["Windows"],"analytic_id":"AN1507","source_url":"https://attack.mitre.org/detectionstrategies/DET0547#AN1507","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN1508","name":"Analytic 1508","guidance":"Abuse of extensible server modules (e.g., Apache, Nginx, Tomcat) to load rogue plugins that initiate bash, connect to C2, or spawn reverse shells.","url":"https://attack.mitre.org/detectionstrategies/DET0547#AN1508","platforms":["Linux"],"tuning":[{"field":"ServerBinaryPath","description":"Alternate install paths like /opt/httpd or user-compiled binaries"},{"field":"OutboundPortRange","description":"Tunable to match expected versus suspicious outbound traffic patterns"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN1508","source_url":"https://attack.mitre.org/detectionstrategies/DET0547#AN1508","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0038","component":"Application Log Content","name":"linux:syslog","channel":"Module registration or stacktrace logs indicating segmentation faults or unknown module errors","platforms":["Linux"],"analytic_id":"AN1508","source_url":"https://attack.mitre.org/detectionstrategies/DET0547#AN1508","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Outbound connections from web server binaries (apache2, nginx, php-fpm) to unknown external IPs","platforms":["Linux"],"analytic_id":"AN1508","source_url":"https://attack.mitre.org/detectionstrategies/DET0547#AN1508","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN1509","name":"Analytic 1509","guidance":"Malicious use of webserver plugins (e.g., for nginx, PHP, Node.js) that execute AppleScript or open network sockets.","url":"https://attack.mitre.org/detectionstrategies/DET0547#AN1509","platforms":["macOS"],"tuning":[{"field":"ParentBinaryPath","description":"If homebrew or manually compiled nginx/httpd used, baseline accordingly."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"Script interpreter invoked by nginx/apache worker process","platforms":["macOS"],"analytic_id":"AN1509","source_url":"https://attack.mitre.org/detectionstrategies/DET0547#AN1509","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"macos:unifiedlog","channel":"Web server process initiating outbound TCP connections not tied to normal server traffic","platforms":["macOS"],"analytic_id":"AN1509","source_url":"https://attack.mitre.org/detectionstrategies/DET0547#AN1509","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN1510","name":"Analytic 1510","guidance":"Use of ESXi web interface plugins or vSphere extensions to embed persistent malicious scripts or services.","url":"https://attack.mitre.org/detectionstrategies/DET0547#AN1510","platforms":["ESXi"],"tuning":[{"field":"PluginVendorName","description":"Whitelist known vendor plug-in names for extension correlation"},{"field":"AccessVector","description":"Limit exposure of plugin installation via HTTPS or SSH"}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"esxi:hostd","channel":"New extension/module install with unknown vendor ID","platforms":["ESXi"],"analytic_id":"AN1510","source_url":"https://attack.mitre.org/detectionstrategies/DET0547#AN1510","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0064","component":"Command Execution","name":"esxi:vmkernel","channel":"Unexpected restarts of management agents or shell access","platforms":["ESXi"],"analytic_id":"AN1510","source_url":"https://attack.mitre.org/detectionstrategies/DET0547#AN1510","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0001","name":"Scheduled Job Creation","tag":"Scheduled Job Creation","page":"telemetry/DC0001/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Enforce the principle of least privilege by limiting privileges of user accounts so only authorized accounts can modify and/or add server software components.(Citation: NSA and ASD Detect and Prevent Web Shells 2020)","relationship_id":"relationship--edbfcc84-4096-4839-b5eb-5025b70ccaca","references":[{"source_name":"NSA and ASD Detect and Prevent Web Shells 2020","description":"NSA and ASD. (2020, April 3). Detect and Prevent Web Shell Malware. Retrieved July 23, 2021.","url":"https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF"}]},{"id":"M1024","name":"Restrict Registry Permissions","url":"https://attack.mitre.org/mitigations/M1024","kind":"course-of-action","description":"Consider using Group Policy to configure and block modifications to service and other critical server parameters in the Registry.(Citation: Microsoft System Services Fundamentals)","relationship_id":"relationship--32c23405-9962-4f12-8774-fdf04328ac84","references":[{"source_name":"Microsoft System Services Fundamentals","description":"Microsoft. (2018, February 17). Windows System Services Fundamentals. Retrieved March 28, 2022.","url":"https://social.technet.microsoft.com/wiki/contents/articles/12229.windows-system-services-fundamentals.aspx"}]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Do not allow administrator accounts that have permissions to add component software on these services to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.","relationship_id":"relationship--f470dae2-81c9-48c4-aeab-27cebe318a09","references":[]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Consider disabling software components from servers when possible to prevent abuse by adversaries.(Citation: ITSyndicate Disabling PHP functions)","relationship_id":"relationship--57350311-f2bd-4ca8-ba95-67c255422bbb","references":[{"source_name":"ITSyndicate Disabling PHP functions","description":"Kondratiev, A. (n.d.). Disabling dangerous PHP functions. Retrieved July 26, 2021.","url":"https://itsyndicate.org/blog/disabling-dangerous-php-functions/"}]},{"id":"M1045","name":"Code Signing","url":"https://attack.mitre.org/mitigations/M1045","kind":"course-of-action","description":"Ensure all application component binaries are signed by the correct application developers.","relationship_id":"relationship--01a603b5-a9b1-4567-864d-6dfaa0430057","references":[]},{"id":"M1046","name":"Boot Integrity","url":"https://attack.mitre.org/mitigations/M1046","kind":"course-of-action","description":"Enabling secure boot allows validation of software and drivers during initial system boot.","relationship_id":"relationship--9ef8bd47-8955-4e56-b801-8626fe696fe8","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Regularly check component software on critical services that adversaries may target for persistence to verify the integrity of the systems and identify if unexpected changes have been made.","relationship_id":"relationship--1071d72e-9ea8-43df-8e82-2831fe0652b7","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1505":"/ttp-simulation/techniques/enterprise/T1505/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1505","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0001","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","action":"create","principal":"lab-user","schedule":"daily","program":"lab-check.exe"}}]}}