Home/ MITRE Matrix/ Persistence/ T1505

T1505Server Software Component

T1505 — Server Software Component is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 3 detection use cases covering it and 1 threat-intel article citing it.

Persistence

View on the matrix → Filter Detection Library MITRE official spec ↗

3Use cases

1Articles

6Sub-techniques

1Tactic

Sub-techniques (6)

T1505.004 · IIS Components T1505.001 · SQL Stored Procedures T1505.005 · Terminal Services DLL T1505.002 · Transport Agent T1505.006 · vSphere Installation Bundles T1505.003 · Web Shell

Use cases covering this technique (3)

Windows Shell Process from CrushFTP ESCU actions · alerting P Confluence Unauthenticated Remote Code Execution CVE-2022-26134 ESCU actions · alerting P [LLM] Splunk Secure Gateway Python script overwritten via PostgreSQL lo_export (CVE-2026-20253) Bespoke install · alerting DSΣPDDCS

Articles citing this technique (1)

crit Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication art-09