Mimic Research

The Server Threat Library

Every attacker technique catalog is written for laptops. Servers are a different world: different binaries, different parents, different normal. This one is for the servers your business actually runs on.

8 techniquesat launch · growing weekly
Linux & Windowsserver-side only
Process ancestrynot just binary names

Most threat libraries are written for laptops. This one is written for servers, not laptops, because the techniques differ and the assumptions that hold on an endpoint do not hold on a domain controller or a database host.

What living off the land means on a server

Living off the land is an attack technique that uses the legitimate tools already installed on a system rather than introducing new malware. PowerShell, WMI, certutil, regsvr32 and dozens of other signed, trusted binaries can be used to move laterally, establish persistence and stage data. Because the binaries are legitimate and signed, signature-based detection has nothing to match on, and behavioral detection has to distinguish malicious use of an admin tool from ordinary use of the same tool by an administrator.

Why servers are the harder case

An enterprise server runs a narrower and more predictable set of software than a laptop, which is an advantage defenders rarely use. The set of binaries that should ever execute on a production database host is small and stable. The set that actually can execute is enormous. That gap is the attack surface this library catalogs.

How known-good enforcement changes the question

Detection asks whether an action looks malicious. On a signed system binary used by an administrator every day, that question is genuinely hard. Known-good enforcement asks whether the change the tool is attempting was authorized. A trusted binary can be used for authorized tasks and still be blocked from making an unauthorized change, because the decision evaluates the change rather than the tool or the credential behind it.

Related reading: The Patch Window, The Exploit Path, and the Known-Good Enforcement Glossary.

About this catalog

The live view below catalogs observed server-side techniques and the trusted binaries associated with them. Sources include LOLBAS, GTFOBins and MITRE ATT&CK.

How attackers abuse the software you already trust

None of these are malware. Every one ships with the operating system or your management stack, which is exactly why they get used — and why signature tools stay quiet. What gives them away is the parent process and the command line, not the file.

What runs on enterprise servers?

Pick an application to see the executables it ships, or search an executable by name to see what it is and who makes it. Drawn from the catalog Mimic builds across production servers — the question VirusTotal doesn't answer: not "is it malware," but "what is this, on a server?"

Loading…
Pick an application on the left to see its executables.

Aggregated across monitored servers, floored at fleet-wide prevalence — never traceable to a single customer.

Loading…

Aggregated across monitored servers, floored at fleet-wide prevalence — never traceable to a single customer.