1200KM / detection
T0866 Exploitation of Remote Services — Detection Rules
Detection workspace for T0866 Exploitation of Remote Services: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0767 Detection of Exploitation of Remote Services
AN1899 Analytic 1899
Real-time monitoring identifies a network-accessible service process (lsass.exe, a vendor remote management service) spawning an unexpected child process or exhibiting cross-process memory access patterns immediately following inbound connection from an unusual source. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
AN2141 Analytic 2141
Real-time monitoring identifies an ICS Linux network-facing service spawning a shell, interpreter, or other child process outside the expected service-child baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
AN2240 Analytic 2240
Real-time monitoring identifies malformed, oversized, or out-of-spec ICS protocol messages sent to an embedded field device from an unexpected or unauthorized source. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
AN2288 Analytic 2288
Real-time monitoring identifies exploit-pattern ICS/network traffic, including malformed packets, out-of-spec function codes, or overflow-sized payloads, targeting ICS servers or field devices from unexpected sources. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
No reviewed association in this snapshot.
Existing anomaly research
Complete technique engineering workbook
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.