IIS Components
Subtechnique · ATTACK:enterprise:T1505.004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1505.004",
"title": "IIS Components",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1505/004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--b46a801b-fd98-491c-a25a-bca25d6e3001",
"external_id": "T1505.004",
"domain": "enterprise",
"created": "2021-06-03T18:44:29.770Z",
"modified": "2025-10-24T17:49:15.437Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"persistence"
],
"source_references": [
{
"source_name": "Dell TG-3390",
"url": "https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"
},
{
"source_name": "Unit 42 RGDoor Jan 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"
},
{
"source_name": "Trustwave IIS Module 2013",
"url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/"
},
{
"source_name": "ESET IIS Malware 2021",
"url": "https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Anatomy-Of-Native-Iis-Malware-wp.pdf"
},
{
"source_name": "IIS Backdoor 2011",
"url": "https://web.archive.org/web/20170106175935/http:/esec-lab.sogeti.com/posts/2011/02/02/iis-backdoor.html"
},
{
"source_name": "Microsoft IIS Modules Overview 2007",
"url": "https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview"
},
{
"source_name": "Microsoft ISAPI Extension All Incoming 2017",
"url": "https://docs.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms525696(v=vs.90)"
},
{
"source_name": "Microsoft ISAPI Extension Overview 2017",
"url": "https://docs.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms525172(v=vs.90)"
},
{
"source_name": "Microsoft ISAPI Filter Overview 2017",
"url": "https://docs.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms524610(v=vs.90)"
},
{
"source_name": "MMPC ISAPI Filter 2012",
"url": "https://web.archive.org/web/20140804175025/http:/blogs.technet.com/b/mmpc/archive/2012/10/03/malware-signed-with-the-adobe-code-signing-certificate.aspx"
}
]
}Explicit source assertions (10)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1505.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05ae3ecc-6920-4828-b708-f0acdf0e2ff3
ATTACK:enterprise:S0258 → uses → ATTACK:enterprise:T1505.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c0b0d7b-239c-4514-9f32-1abb8aa44dbc
Unit 42 RGDoor Jan 2018 · ESET IIS Malware 2021ATTACK:enterprise:T1505.004 → subtechnique-of → ATTACK:enterprise:T1505
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5dedb236-b37b-4e6b-bd3d-a09ddc1e9c17
ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1505.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--652ba0d5-1bd3-4dcb-93c5-f339ffdae886
CrowdStrike IceApple May 2022ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1505.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7742d5c6-6987-4a87-92e9-c213880d911a
Microsoft ISAPICGIRestriction 2016ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1505.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f93da44-6aa1-4f59-95c7-89c849423da9
ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1505.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2c0d9fd-5ce9-4df1-8218-771b111bc1e4
McAfee Lazarus Jul 2020ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1505.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a49c8e4c-876a-4771-a1e5-f54aad2f0fcd
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:M1045 → mitigates → ATTACK:enterprise:T1505.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b736ab77-4dd6-4c80-8b8a-d15446436e0e
ATTACK:enterprise:S0072 → uses → ATTACK:enterprise:T1505.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1884e62-7b2e-45a1-89fd-c76b1b717f50
Dell TG-3390