t1505-004-iis-components

name	T1505.004_iis-components
description	Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1505.004","persistence","windows","sub-technique"]
technique_id	T1505.004
tactic	persistence
all_tactics	["persistence"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1505/004
tech_stack	["windows"]
cwe_ids	["CWE-276"]
chains_with	["T1505","T1505.001","T1505.002","T1505.003","T1505.005","T1505.006"]
prerequisites	["T1505"]
severity_boost	{"T1505":"Chain with T1505 for deeper attack path","T1505.001":"Chain with T1505.001 for deeper attack path","T1505.002":"Chain with T1505.002 for deeper attack path"}

T1505.004 IIS Components

Sub-technique of: T1505

High-Level Description

Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions: Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}. IIS modules may also be installed to extend IIS web servers.

Adversaries may install malicious ISAPI extensions and filters to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic. ISAPI extensions and filters may have access to all IIS web requests and responses. For example, an adversary may abuse these mechanisms to modify HTTP responses in order to distribute malicious commands/content to previously comprised hosts.

Adversaries may also install malicious IIS modules to observe and/or modify traffic. IIS 7.0 introduced modules that provide the same unrestricted access to HTTP requests and responses as ISAPI extensions and filters. IIS modules can be written as a DLL that exports RegisterModule, or as a .NET application that interfaces with ASP.NET APIs to access IIS HTTP requests.

Kill Chain Phase

• Persistence (TA0003)

Platforms: Windows

What to Check

• Identify if IIS Components technique is applicable to target environment
• Check Windows systems for indicators of IIS Components
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Install IIS Module using AppCmd.exe

The following Atomic will utilize AppCmd.exe to install a new IIS Module. IIS must be installed. This atomic utilizes a DLL on disk, but to test further suspiciousness, compile and load IIS-Raid. A successful execution will install a module into IIS using AppCmd.exe.