T1505 Server Software Component
EnterpriseAdversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-techniques (6)
More specific entries beneath this one.
mitigations
ATT&CK mitigations that reduce this.
detected by (6)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.PSPlatform Securitymoderate · backed by 8 of 21 mapped controls
- ID.RARisk Assessmentmoderate · backed by 7 of 21 mapped controls
- PR.AAIdentity Management, Authentication, and Access Controlmoderate · backed by 6 of 21 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (21)
Security controls that mitigate this.
known-exploited CVEs (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-49706US | —OT critical | KEV | ||
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2022-29303US | critical9.8OT critical | KEV | ||
SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php. | ||||
campaigns (1)
Campaigns that use this.
Detected by (Sigma) (1)
Sigma detection rules related to this.
source
Where this definition is published.