MITRE ATT&CK detection coverage

← Back to main site

Home/ MITRE Matrix/ Persistence/ T1505.004

T1505.004IIS Components

T1505.004 — IIS Components is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 11 detection use cases covering it.

Persistence

View on the matrix → Filter Detection Library MITRE official spec ↗

11Use cases

0Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1505 · Server Software Component

Use cases covering this technique (11)

[WEEKLY] Internet-facing server process spawns interpreter then beacons to first-seen external host within 5 minutes Internal install · alerting DSPDD Windows Disable Windows Event Logging Disable HTTP Logging ESCU actions · hunting P Windows IIS Components Add New Module ESCU actions · hunting P Windows IIS Components Get-WebGlobalModule Module Query ESCU actions · hunting P Windows IIS Components Module Failed to Load ESCU actions · hunting P Windows IIS Components New Module Added ESCU actions · alerting P Windows PowerShell Add Module to Global Assembly Cache ESCU actions · alerting P Windows PowerShell Disable HTTP Logging ESCU actions · alerting P Windows PowerShell IIS Components WebGlobalModule Usage ESCU actions · hunting P Windows Server Software Component GACUtil Install to GAC ESCU actions · alerting P Windows Shell or Script Execution From IIS Directory ESCU actions · hunting P