Cross-source coverage
T1190 / ATT&CK
Exploit Public-Facing Application
6569 rules · 6395 families across 11 sources.
846 deprecated hidden · include 5 atomic-IOC hidden · include
From MITRE ATT&CK 19.2
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution.
If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies.
Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.
For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.
- Tactics
- Initial Access
- Platforms
- Containers · ESXi · IaaS · Linux · macOS · Network Devices · Windows
- Telemetry
-
ApplicationLog:IISWinEventLog:SysmonApplicationLog:WebServerauditd:SYSCALLNSM:Flowmacos:unifiedlogApplicationLog:Ingressdocker:eventsALB:HTTPLogsAWS:VPCFlowLogsesxi:hostdnetworkdevice:controlplane
How MITRE says to detect it DET0080
Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
Windows Analytic 0219
Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.
ApplicationLog:IISIIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns)WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=7WinEventLog:SysmonEventCode=3, 22
Linux Analytic 0220
Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.
ApplicationLog:WebServer/var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errorsauditd:SYSCALLexecveNSM:FlowHTTP payloads with SQLi/LFI/JNDI/deserialization indicators
macOS Analytic 0221
Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.
macos:unifiedlogApp/web server logs ingested via unified logging or filebeat (nginx/apache/node).macos:unifiedlogexec events where web process starts a shell/toolingNSM:Flowoutbound egress from web host after suspicious request
Containers Analytic 0222
Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).
ApplicationLog:IngressKubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikesdocker:eventsDocker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside containerNSM:FlowRequests towards cloud metadata or command & control from pod IPs
IaaS Analytic 0223
Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.
ALB:HTTPLogsAWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx burstsAWS:VPCFlowLogsVPC/NSG flow logs for pod/instance egress to Internet or metadata
ESXi Analytic 0224
Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.
esxi:hostd/var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connectionsNSM:FlowConnections to TCP 427 (SLP) or vCenter web services from untrusted sources
Network Devices Analytic 0225
Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.
networkdevice:controlplaneSyslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commandsNSM:FlowNetFlow/sFlow for odd egress to Internet from mgmt plane
Emerging Threats Open
6173 rules · 6004 families| Detection | Severity | Format |
|---|---|---|
| ET EXPLOIT Apache ActiveMQ Remote Code Execution Attempt (CVE-2023-46604) | Critical | Suricata |
| ET EXPLOIT Cisco Catalyst Remote Code Execution (CVE-2017-3881) | Critical | Suricata |
| ET EXPLOIT Nagios XI Remote Code Execution | Critical | Suricata |
| ET EXPLOIT Nagios XI Remote Code Execution 2 | Critical | Suricata |
| ET EXPLOIT Nagios XI Remote Code Execution 3 | Critical | Suricata |
| ET EXPLOIT Nagios XI SQL Injection | Critical | Suricata |
| ET EXPLOIT Nagios XI SQL Injection 2 | Critical | Suricata |
| ET EXPLOIT Selenium Server Grid Chrome 3.141.59 Remote Code Execution - Successful | Critical | Suricata |
| ET EXPLOIT Successful Apache ActiveMQ Remote Code Execution (CVE-2023-46604) | Critical | Suricata |
| ET MALWARE Wordpress Social Warfare Plugin Exploit CMS Users Exfil M2 3 variants | Critical | Suricata |
+ 6163 more from Emerging Threats Open → showing the 10 highest-severity
SigmaHQ/sigma
148 rules| Detection | Severity | Format |
|---|---|---|
| Arcadyan Router Exploitations | Critical | Sigma |
| Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195 | Critical | Sigma |
| Citrix Netscaler Attack CVE-2019-19781 | Critical | Sigma |
| Confluence Exploitation CVE-2019-3398 | Critical | Sigma |
| CVE-2010-5278 Exploitation Attempt | Critical | Sigma |
| CVE-2020-0688 Exchange Exploitation via Web Log | Critical | Sigma |
| CVE-2020-10148 SolarWinds Orion API Auth Bypass | Critical | Sigma |
| CVE-2020-5902 F5 BIG-IP Exploitation Attempt | Critical | Sigma |
| CVE-2021-33766 Exchange ProxyToken Exploitation | Critical | Sigma |
| CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit | Critical | Sigma |
+ 138 more from SigmaHQ/sigma → showing the 10 highest-severity
splunk/security_content
112 rules| Detection | Severity | Format |
|---|---|---|
| Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint | Undefined | SPL |
| Adobe ColdFusion Access Control Bypass | Undefined | SPL |
| Adobe ColdFusion Unauthenticated Arbitrary File Read | Undefined | SPL |
| Cisco IOS XE Implant Access | Undefined | SPL |
| Cisco IOS XE Request Platform Package Describe Shell Pattern | Undefined | SPL |
| Cisco IOS XE WebUI Login From IOSd Local Port | Undefined | SPL |
| Cisco IOS XE WebUI Programmatic Configuration | Undefined | SPL |
| Cisco NVM - Webserver Download From File Sharing Website | Undefined | SPL |
| Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity | Undefined | SPL |
| Cisco SD-WAN - Low Frequency Rogue Peer | Undefined | SPL |
+ 102 more from splunk/security_content → showing the 10 highest-severity
elastic/detection-rules
54 rules| Detection | Severity | Format |
|---|---|---|
| Potential Redis Lua Use-After-Free RCE Attempt (CVE-2025-49844 / RediShell) | Critical | Elastic TOML |
| Potential Telnet Authentication Bypass (CVE-2026-24061) | Critical | Elastic TOML |
| Telnet Authentication Bypass via User Environment Variable | Critical | Elastic TOML |
| FortiGate SSO Login Followed by Administrator Account Creation | High | Elastic TOML |
| Microsoft Exchange Worker Spawning Suspicious Processes | High | Elastic TOML |
| Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) | High | Elastic TOML |
| Potential JAVA/JNDI Exploitation Attempt | High | Elastic TOML |
| Potential Redis CONFIG SET SSH Authorized Key Injection | High | Elastic TOML |
| Potential SAP NetWeaver Exploitation | High | Elastic TOML |
| Potential SQL Injection Against Microsoft SQL Server | High | Elastic TOML |
+ 44 more from elastic/detection-rules → showing the 10 highest-severity
Azure/Azure-Sentinel
27 rules| Detection | Severity | Format |
|---|---|---|
| Application Gateway WAF - SQLi Detection | High | KQL |
| Exchange SSRF Autodiscover ProxyShell - Detection | High | KQL |
| Microsoft Defender for Endpoint (MDE) signatures for Azure Synapse pipelines and Azure Data Factory | High | KQL |
| PulseConnectSecure - CVE-2021-22893 Possible Pulse Connect Secure RCE Vulnerability Attack | High | KQL |
| Vulnerable Machines related to OMIGOD CVE-2021-38647 | High | KQL |
| Exchange Server Suspicious File Downloads. | Medium | KQL |
| High count of connections by client IP on many ports | Medium | KQL |
| OMI Vulnerability Exploitation | Medium | KQL |
| Silk Typhoon New UM Service Child Process | Medium | KQL |
| Silk Typhoon Suspicious Exchange Request | Medium | KQL |
+ 17 more from Azure/Azure-Sentinel → showing the 10 highest-severity
Wazuh Core Ruleset
18 rules · 14 families| Detection | Severity | Format |
|---|---|---|
| F5 BigIP ASM: SQL injection detected · cs4 = SQL-Injection | Critical | Wazuh XML |
| Shellshock attack detected 2 variants | Critical | Wazuh XML |
| Shellshock attack detected 2 variants | Critical | Wazuh XML |
| sshd: Possible scan or breakin attempt (high number of login timeouts). | High | Wazuh XML |
| A web attack returned code 200 (success). | Medium | Wazuh XML |
| Cart.php directory transversal attempt. | Medium | Wazuh XML |
| Common web attack. | Medium | Wazuh XML |
| MSSQL Injection attempt (/ur.php, urchin.js) | Medium | Wazuh XML |
| osCommerce login.php bypass attempt. | Medium | Wazuh XML |
| Palo Alto Traffic: Session dropped on from to . Reason: . Action: . · content_type = (?:drop|deny) | Medium | Wazuh XML |
+ 8 more from Wazuh Core Ruleset → showing the 10 highest-severity
panther-labs/panther-analysis
18 rules| Detection | Severity | Format |
|---|---|---|
| AWS WAF Managed Admin Protection Passthrough Rule | High | Panther Python |
| AWS WAF Managed Known Bad Inputs Passthrough Rule | High | Panther Python |
| AWS WAF Managed SQL Database Passthrough Rule | High | Panther Python |
| AWS WAF ReactJS RCE Attempt via Body | High | Panther Python |
| CVE-2023-7028 - GitLab Audit Password Reset Multiple Emails | High | Panther Python |
| CVE-2023-7028 - GitLab Production Password Reset Multiple Emails | High | Panther Python |
| GCP K8S Service Type NodePort Deployed | High | Panther Python |
| Kubernetes NodePort Service Deployed | High | Panther Python |
| Kubernetes System Principal Accessed from Non-Cloud Public IP | High | Panther Python |
| AppOmni Alert Passthrough | Medium | Panther Python |
+ 8 more from panther-labs/panther-analysis → showing the 10 highest-severity
elastic/protections-artifacts
13 rules| Detection | Severity | Format |
|---|---|---|
| Payload Downloaded via Curl or Wget by Web Server | Undefined | Elastic TOML |
| Payload Execution by Node.js Web Server | Undefined | Elastic TOML |
| Payload Execution by Web Server | Undefined | Elastic TOML |
| Potential Remote Code Execution via Database Server | Undefined | Elastic TOML |
| Potential Remote Code Execution via Mail Server | Undefined | Elastic TOML |
| Potential Telnet Authentication Bypass (CVE-2026-24061) | Undefined | Elastic TOML |
| Potential WebShell via ScreenConnect Server | Undefined | Elastic TOML |
| Suspicious Microsoft IIS Child Process | Undefined | Elastic TOML |
| Suspicious Microsoft IIS Worker Descendant | Undefined | Elastic TOML |
| Suspicious Process from FortiClient VPN Trace Script | Undefined | Elastic TOML |
+ 3 more from elastic/protections-artifacts → showing the 10 highest-severity
Bert-JanP/Hunting-Queries-Detection-Rules
3 rules| Detection | Severity | Format |
|---|---|---|
| List internet facing devices with vulnerabilities that have an exploit available | Undefined | KQL |
| MITRE ATT&CK Mapping | Undefined | KQL |
| New Active CISA Know Exploited Vulnerability Detected | Undefined | KQL |
falcosecurity/rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Java Process Class File Download | Critical | Falco YAML |
| DB program spawned process | Low | Falco YAML |
chronicle/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| sap_gateway_acl_bypass_attempt | Low | YARA-L |