CmdID

CmdID / Techniques / T1505

T1505.004 Server Software Component: IIS Components

Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. MITRE ATT&CK

1 Sigma rule T1505.004 on attack.mitre.org

Part of

MITRE ATT&CK

T1505Server Software Component

Sigma rules tagged with it

process creation, the highest levels first

highSuspicious IIS Module RegistrationFlorian Roth (Nextron Systems), Microsoft (idea) · Windows