T1190 Exploit Public-Facing Application — Detection Rules

Source-backed rule directory

• Django Framework Exceptions · stable · medium · {"category":"application","product":"django"}
• Potential JNDI Injection Exploitation In JVM Based Application · test · high · {"category":"application","product":"jvm","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"}
• Potential Local File Read Vulnerability In JVM Based Application · test · high · {"category":"application","product":"jvm","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"}
• Potential OGNL Injection Exploitation In JVM Based Application · test · high · {"category":"application","product":"jvm","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"}
• Process Execution Error In JVM Based Application · test · high · {"category":"application","product":"jvm","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"}
• Potential XXE Exploitation Attempt In JVM Based Application · test · high · {"category":"application","product":"jvm","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"}
• Potential RCE Exploitation Attempt In NodeJS · test · high · {"category":"application","product":"nodejs","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"}
• OpenCanary - FTP Login Attempt · test · high · {"category":"application","product":"opencanary"}
• OpenCanary - HTTP GET Request · test · high · {"category":"application","product":"opencanary"}
• OpenCanary - HTTP POST Login Attempt · test · high · {"category":"application","product":"opencanary"}
• Python SQL Exceptions · stable · medium · {"category":"application","product":"python"}
• Ruby on Rails Framework Exceptions · stable · medium · {"category":"application","product":"ruby_on_rails"}
• Spring Framework Exceptions · stable · medium · {"category":"application","product":"spring"}
• Potential SpEL Injection In Spring Framework · test · high · {"category":"application","product":"spring","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"}
• Suspicious SQL Error Messages · test · high · {"category":"application","product":"sql","definition":"Requirements: application error logs must be collected (with LOG_LEVEL ERROR and above)"}
• Potential Server Side Template Injection In Velocity · test · high · {"category":"application","product":"velocity","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"}
• Suspicious SQL Query · test · medium · {"category":"database","definition":"Requirements: Must be able to log the SQL queries"}
• Ingress/Egress Security Group Modification · test · medium · {"product":"aws","service":"cloudtrail"}
• LoadBalancer Security Group Modification · test · medium · {"product":"aws","service":"cloudtrail"}
• RDS Database Security Group Modification · test · medium · {"product":"aws","service":"cloudtrail"}
• Suspicious OpenSSH Daemon Error · test · medium · {"product":"linux","service":"sshd"}
• Suspicious Named Error · test · high · {"product":"linux","service":"syslog"}
• Suspicious VSFTPD Error Messages · test · medium · {"product":"linux","service":"vsftpd"}
• OMIGOD SCX RunAsProvider ExecuteScript · test · high · {"product":"linux","category":"process_creation"}
• OMIGOD SCX RunAsProvider ExecuteShellCommand · test · high · {"product":"linux","category":"process_creation"}
• DNS Query to External Service Interaction Domains · test · high · {"category":"dns"}
• Apache Threading Error · test · medium · {"service":"apache","definition":"Requirements: Must be able to collect the error.log file"}
• F5 BIG-IP iControl Rest API Command Execution - Proxy · test · medium · {"category":"proxy"}
• Hack Tool User Agent · test · high · {"category":"proxy"}
• F5 BIG-IP iControl Rest API Command Execution - Webserver · test · medium · {"category":"webserver"}
• Successful IIS Shortname Fuzzing Scan · test · medium · {"category":"webserver"}
• Java Payload Strings · test · high · {"category":"webserver"}
• JNDIExploit Pattern · test · high · {"category":"webserver"}
• Path Traversal Exploitation Attempts · test · medium · {"category":"webserver"}
• SQL Injection Strings In URI · test · high · {"category":"webserver"}
• Suspicious User-Agents Related To Recon Tools · test · medium · {"category":"webserver"}
• Failed Logon From Public IP · test · medium · {"product":"windows","service":"security"}
• Suspicious File Drop by Exchange · test · medium · {"product":"windows","category":"file_event"}
• Suspicious MSExchangeMailboxReplication ASPX Write · test · high · {"product":"windows","category":"file_event"}
• Suspicious File Write to Webapps Root Directory · experimental · medium · {"product":"windows","category":"file_event"}
• Suspicious File Write to SharePoint Layouts Directory · experimental · high · {"product":"windows","category":"file_event"}
• Suspicious Child Process Of SQL Server · test · high · {"category":"process_creation","product":"windows"}
• Remote Access Tool - ScreenConnect Server Web Shell Execution · test · high · {"product":"windows","category":"process_creation"}
• Terminal Service Process Spawn · test · high · {"product":"windows","category":"process_creation"}
• Suspicious Process By Web Server Process · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Processes Spawned by WinRM · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1190 Exploit Public-Facing Application

MATCH(waf_exploit_signature OR ids_exploit_signature OR known_exploit_request_pattern) -> ALERT

• Web Application Firewall Logs
• Network Intrusion Detection Logs
• Web Server Access Logs
• Atlas source section

Anomaly models

ATT&CK analytic guidance

DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)

AN0219 Analytic 0219

Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

AN0220 Analytic 0220

Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

AN0221 Analytic 0221

Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

AN0222 Analytic 0222

Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

AN0223 Analytic 0223

Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

AN0224 Analytic 0224

Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

AN0225 Analytic 0225

Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.