T1505.004Persistence

IIS Components

Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions…

attack.mitre.org ↗

CVEs0

In 0

Reports0

Detections

5 Sigma rules tagged T1505.004

IIS ComponentsT1505.0045 general rules

HTTP Logging Disabled On IIS Serverhightest
Suspicious IIS Module Registrationhightest
ETW Logging/Processing Option Disabled On IIS Servermediumtest
New Module Module Added To IIS Servermediumtest
Previously Installed IIS Module Was Removedlowtest

CVEs linked to IIS Components

0 CVEs, by priority. Each link shows its badge.

No CVEs are linked to this technique yet.