AN1507
Analytic 1507
Windows
Installation of malicious IIS/Apache/SQL server modules that later execute command-line interpreters or establish outbound connections.
WinEventLog:Security
EventCode=4698
WinEventLog:Sysmon
EventCode=1
WinEventLog:Application
Unusual DLL/plugin registration for IIS/SQL/Apache or unexpected error logs
[TimeWindow]
Time delta between module install and process execution (e.g., persistence delay).
[ParentProcessName]
Custom server wrapper processes or renamed webserver processes may require tuning.
AN1508
Analytic 1508
Linux
Abuse of extensible server modules (e.g., Apache, Nginx, Tomcat) to load rogue plugins that initiate bash, connect to C2, or spawn reverse shells.
auditd:SYSCALL
execve
linux:syslog
Module registration or stacktrace logs indicating segmentation faults or unknown module errors
NSM:Flow
Outbound connections from web server binaries (apache2, nginx, php-fpm) to unknown external IPs
[ServerBinaryPath]
Alternate install paths like /opt/httpd or user-compiled binaries
[OutboundPortRange]
Tunable to match expected versus suspicious outbound traffic patterns
AN1509
Analytic 1509
macOS
Malicious use of webserver plugins (e.g., for nginx, PHP, Node.js) that execute AppleScript or open network sockets.
macos:unifiedlog
Script interpreter invoked by nginx/apache worker process
macos:unifiedlog
Web server process initiating outbound TCP connections not tied to normal server traffic
[ParentBinaryPath]
If homebrew or manually compiled nginx/httpd used, baseline accordingly.
AN1510
Analytic 1510
ESXi
Use of ESXi web interface plugins or vSphere extensions to embed persistent malicious scripts or services.
esxi:hostd
New extension/module install with unknown vendor ID
esxi:vmkernel
Unexpected restarts of management agents or shell access
[PluginVendorName]
Whitelist known vendor plug-in names for extension correlation
[AccessVector]
Limit exposure of plugin installation via HTTPS or SSH