H3XA — Operational Evidence

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)

13 recorded

Relationships

mitigates

from Audit

Mitigation

mitigates

from Boot Integrity

Mitigation

mitigates

from Code Signing

Mitigation

mitigates

from Disable or Remove Feature or Program

Mitigation

mitigates

from Privileged Account Management

Mitigation

mitigates

from Restrict Registry Permissions

Mitigation

mitigates

from User Account Management

Mitigation

subtechnique-of

from IIS Components

Technique

subtechnique-of

from SQL Stored Procedures

Technique

subtechnique-of

from Terminal Services DLL

Technique

subtechnique-of

from Transport Agent

Technique

subtechnique-of

from vSphere Installation Bundles

Technique

subtechnique-of

Technique

3 external

References

mitre-attack

T1505

volexity_0day_sophos_FW

https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/

US-CERT Alert TA15-314A Web Shells

https://www.us-cert.gov/ncas/alerts/TA15-314A