T1190 Exploit Public-Facing Application — Attack Simulation

DC0038 collection page — Select the application event family required by the detection and document its native schema before normalization.

Providers and collection configuration

• Application audit logs: First-party service events and request/result fields; schema is application-specific.
• OpenTelemetry-compatible log pipelines: Transport and normalization of emitted records; do not create missing audit instrumentation.

• Enable the application audit category or instrument the owned lab application at the authorization/action boundary.
• Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.
• Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart.

Required normalized fields: service, action, actor, record_count, result.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0038",
  "collector": "illustrative-lab-collector",
  "observation": {
    "service": "lab-portal",
    "action": "export_requested",
    "actor": "lab-reader",
    "record_count": 3,
    "result": "authorized"
  }
}

Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.

DC0016 collection page — Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_id, image_loaded, signed, action.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0016",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "image_loaded": "C:\\Lab\\demo.dll",
    "signed": false,
    "action": "load"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0082 collection page — Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, destination_ip, destination_port, protocol, initiated.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0082",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "initiated": true
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0085 collection page — Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: flow_id, protocol, method, path, payload_excerpt.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0085",
  "collector": "illustrative-lab-collector",
  "observation": {
    "flow_id": "lab-flow-1",
    "protocol": "http",
    "method": "GET",
    "path": "/lab-check",
    "payload_excerpt": "LAB_TELEMETRY_CHECK"
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

DC0078 collection page — Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
• AWS VPC Flow Logs: IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: source_ip, destination_ip, destination_port, protocol, bytes_sent, bytes_received.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0078",
  "collector": "illustrative-lab-collector",
  "observation": {
    "source_ip": "192.0.2.10",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "bytes_sent": 128,
    "bytes_received": 512
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

MITRE detection strategy

46 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

• Django Framework Exceptions — stable; category: application; product: django.
• Potential JNDI Injection Exploitation In JVM Based Application — test; category: application; product: jvm; definition: Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above).
• Potential Local File Read Vulnerability In JVM Based Application — test; category: application; product: jvm; definition: Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above).
• Potential OGNL Injection Exploitation In JVM Based Application — test; category: application; product: jvm; definition: Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above).
• Process Execution Error In JVM Based Application — test; category: application; product: jvm; definition: Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above).
• Potential XXE Exploitation Attempt In JVM Based Application — test; category: application; product: jvm; definition: Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above).
• Potential RCE Exploitation Attempt In NodeJS — test; category: application; product: nodejs; definition: Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above).
• OpenCanary - FTP Login Attempt — test; category: application; product: opencanary.
• OpenCanary - HTTP GET Request — test; category: application; product: opencanary.
• OpenCanary - HTTP POST Login Attempt — test; category: application; product: opencanary.
• Python SQL Exceptions — stable; category: application; product: python.
• Ruby on Rails Framework Exceptions — stable; category: application; product: ruby_on_rails.
• Spring Framework Exceptions — stable; category: application; product: spring.
• Potential SpEL Injection In Spring Framework — test; category: application; product: spring; definition: Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above).
• Suspicious SQL Error Messages — test; category: application; product: sql; definition: Requirements: application error logs must be collected (with LOG_LEVEL ERROR and above).
• Potential Server Side Template Injection In Velocity — test; category: application; product: velocity; definition: Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above).
• Suspicious SQL Query — test; category: database; definition: Requirements: Must be able to log the SQL queries.
• Ingress/Egress Security Group Modification — test; product: aws; service: cloudtrail.
• LoadBalancer Security Group Modification — test; product: aws; service: cloudtrail.
• RDS Database Security Group Modification — test; product: aws; service: cloudtrail.
• Suspicious OpenSSH Daemon Error — test; product: linux; service: sshd.
• Suspicious Named Error — test; product: linux; service: syslog.
• Suspicious VSFTPD Error Messages — test; product: linux; service: vsftpd.
• OMIGOD SCX RunAsProvider ExecuteScript — test; product: linux; category: process_creation.
• OMIGOD SCX RunAsProvider ExecuteShellCommand — test; product: linux; category: process_creation.
• DNS Query to External Service Interaction Domains — test; category: dns.
• Apache Threading Error — test; service: apache; definition: Requirements: Must be able to collect the error.log file.
• F5 BIG-IP iControl Rest API Command Execution - Proxy — test; category: proxy.
• Hack Tool User Agent — test; category: proxy.
• F5 BIG-IP iControl Rest API Command Execution - Webserver — test; category: webserver.
• Successful IIS Shortname Fuzzing Scan — test; category: webserver.
• Java Payload Strings — test; category: webserver.
• JNDIExploit Pattern — test; category: webserver.
• Path Traversal Exploitation Attempts — test; category: webserver.
• SQL Injection Strings In URI — test; category: webserver.
• Suspicious User-Agents Related To Recon Tools — test; category: webserver.
• Failed Logon From Public IP — test; product: windows; service: security.
• Suspicious File Drop by Exchange — test; product: windows; category: file_event.
• Suspicious MSExchangeMailboxReplication ASPX Write — test; product: windows; category: file_event.
• Suspicious File Write to Webapps Root Directory — experimental; product: windows; category: file_event.
• Suspicious File Write to SharePoint Layouts Directory — experimental; product: windows; category: file_event.
• Suspicious Child Process Of SQL Server — test; category: process_creation; product: windows.
• Remote Access Tool - ScreenConnect Server Web Shell Execution — test; product: windows; category: process_creation.
• Terminal Service Process Spawn — test; product: windows; category: process_creation.
• Suspicious Process By Web Server Process — test; category: process_creation; product: windows.
• Suspicious Processes Spawned by WinRM — test; category: process_creation; product: windows.

• S0224 Havij — tool.

  Havij is used to automate SQL injection.[Check Point Havij Analysis]

  Exact relationship: relationship--ced175fd-1f27-44cb-8d7f-44277b1754e4
• S0225 sqlmap — tool.

  sqlmap can be used to automate exploitation of SQL injection vulnerabilities.[sqlmap Introduction]

  Exact relationship: relationship--547b575e-bc3c-488a-ae38-8bf6387b33f5
• S0412 ZxShell — malware.

  ZxShell has been dropped through exploitation of CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.[Talos ZxShell Oct 2014]

  Exact relationship: relationship--66fe07f5-fe08-4ad1-98b6-cb300007fe42
• S0516 SoreFang — malware.

  SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.[CISA SoreFang July 2016]

  Exact relationship: relationship--61ee8aa7-89fc-4414-97f3-95fa9f1f26ad
• S0623 Siloscape — malware.

  Siloscape is executed after the attacker gains initial access to a Windows container using a known vulnerability.[Unit 42 Siloscape Jun 2021]

  Exact relationship: relationship--26ecce49-13ab-43a9-a626-10dae30b6961
• S1105 COATHANGER — malware.

  COATHANGER is installed following exploitation of a vulnerable FortiGate device. [NCSC-NL COATHANGER Feb 2024]

  Exact relationship: relationship--6bbf2f6b-de27-435b-bf3e-bc991a25e561
• S1184 BOLDMOVE — malware.

  BOLDMOVE is associated with exploitation of CVE-2022-49475 in FortiOS.[Google Cloud BOLDMOVE 2023]

  Exact relationship: relationship--a7fbea9e-99a2-4319-b159-f4cb18908c27
• S1242 Qilin — malware.

  Qilin has been delivered through exploitation of exposed applications and interfaces including Citrix and RDP.[SentinelOne Qilin NOV 2022]

  Exact relationship: relationship--96295901-89c2-4646-b18f-3d2eeec651ba

• M1016 Vulnerability Scanning

  Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.[OWASP Top 10]

• M1026 Privileged Account Management

  Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.

• M1030 Network Segmentation

  Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.

• M1035 Limit Access to Resource Over Network

  Ensure that all publicly exposed services are actually intended to be so, and restrict access to any that should only be available internally.

• M1037 Filter Network Traffic

  Restrict outbound network traffic from public-facing servers to prevent unauthorized connections from initiating communications with attacker-controlled infrastructure. While this may not prevent the initial exploitation, it limits the attacker's ability to verify and control the compromised server post-exploit, reducing the overall impact of the attack.

• M1048 Application Isolation and Sandboxing

  Application isolation will limit what other processes and system features the exploited target can access.

• M1050 Exploit Protection

  Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.

• M1051 Update Software

  Update software regularly by employing patch management for externally exposed applications.