Server Software Component

Info

ID:
Tactic: Deepening Control

Server Software Component

Adversaries may install or modify backend modules—like a webshell, SQL stored procedure, or plugin—to run malicious logic within core server processes. By hooking into existing frameworks, they gain an on‑demand way to execute code that appears native to the server’s functionality. This stealth can make detection difficult, as the malicious component may mimic standard plugins or system libraries.

Web servers, application servers, and databases often support extensive plugin architectures. Attackers who gain admin‑level access can add or replace components that load automatically, letting them intercept requests, spawn new processes, or steal data mid‑transaction. This method is particularly potent in high‑traffic production environments, where legitimate activity masks malicious triggers.