Which SIEM platforms have a T1190 detection rule?

df00tech provides T1190 (Exploit Public-Facing Application) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Exploit Public-Facing Application (T1190)?

Detecting Exploit Public-Facing Application requires the following data sources: Process: Process Creation, Microsoft Defender for Endpoint.

What severity and confidence is the T1190 detection?

The T1190 detection is rated critical severity with high confidence.

What are common false positives for T1190?

Common false positives for T1190 include: Legitimate web application frameworks that invoke system utilities as part of normal operation — e.g., Node.js applications using child_process.exec() for image processing, PDF generation, or video transcoding; Application deployment automation where IIS app pools or Java application servers execute build tools, packaging scripts, or health check commands as part of CI/CD pipelines; Exchange Hybrid Configuration Wizard and other Microsoft management tools that run Exchange worker processes spawning PowerShell for legitimate configuration and maintenance tasks.

T1190

Exploit Public-Facing Application

Initial Access Last updated: April 19, 2026

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services or VMware vCenter servers. If an application is hosted on cloud-based infrastructure and/or is containerized, exploiting it may lead to compromise of the underlying instance or container, allowing adversaries to access cloud or container APIs, escape to the container host, or exploit weak identity and access management policies.

What is T1190 Exploit Public-Facing Application?

Exploit Public-Facing Application (T1190) maps to the Initial Access tactic — the adversary is trying to get into your network in MITRE ATT&CK.

This page provides production-ready detection logic for Exploit Public-Facing Application, covering the data sources and telemetry it touches: Process: Process Creation, Microsoft Defender for Endpoint. The queries below are rated critical severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Initial Access
Technique: T1190 Exploit Public-Facing Application
Canonical reference: https://attack.mitre.org/techniques/T1190/

Microsoft Sentinel / Defender

kusto

let WebServerProcesses = dynamic(["w3wp.exe", "httpd.exe", "nginx.exe", "apache2.exe", "java.exe", "python.exe", "python3.exe", "php.exe", "php-cgi.exe", "node.exe", "ruby.exe", "perl.exe", "tomcat9.exe", "tomcat8.exe", "ews.exe", "umworkerprocess.exe", "msexchangeservicehost.exe"]);
let SuspiciousChildProcesses = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe", "nc.exe", "ncat.exe", "net.exe", "net1.exe", "whoami.exe", "ipconfig.exe", "systeminfo.exe", "nltest.exe", "ping.exe", "nslookup.exe", "tasklist.exe", "quser.exe", "schtasks.exe", "at.exe", "sc.exe", "reg.exe"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (WebServerProcesses)
| where FileName in~ (SuspiciousChildProcesses)
| extend ExploitEvidence = case(
    FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe"), "Shell Spawned",
    FileName in~ ("certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe", "nc.exe", "ncat.exe"), "Download/C2 Tool",
    FileName in~ ("whoami.exe", "ipconfig.exe", "systeminfo.exe", "nltest.exe", "net.exe", "net1.exe", "tasklist.exe", "quser.exe"), "Reconnaissance",
    FileName in~ ("schtasks.exe", "at.exe", "sc.exe", "reg.exe"), "Persistence Attempt",
    "Suspicious Child"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName,
         ExploitEvidence, SHA256
| sort by Timestamp desc

Detects web application exploitation by monitoring for web server processes (IIS w3wp.exe, Apache httpd.exe, Nginx, Java/Tomcat, Exchange worker processes) spawning unexpected child processes such as command shells, reconnaissance tools, download utilities, or persistence mechanisms. This parent-child process anomaly is a strong indicator of successful remote code execution via exploitation of a public-facing application, consistent with techniques used by APT28, Volt Typhoon, Sandworm, FIN7, and ransomware operators targeting Exchange, IIS, WebLogic, and similar platforms. Classifies spawned processes into Shell Spawned, Download/C2 Tool, Reconnaissance, and Persistence Attempt categories for analyst prioritization.

critical severity high confidence

Data Sources

Process: Process Creation Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

Legitimate web application frameworks that invoke system utilities as part of normal operation — e.g., Node.js applications using child_process.exec() for image processing, PDF generation, or video transcoding
Application deployment automation where IIS app pools or Java application servers execute build tools, packaging scripts, or health check commands as part of CI/CD pipelines
Exchange Hybrid Configuration Wizard and other Microsoft management tools that run Exchange worker processes spawning PowerShell for legitimate configuration and maintenance tasks
Application Performance Monitoring (APM) and diagnostic agents (Dynatrace, AppDynamics, New Relic) that fork child processes for JVM or CLR diagnostics from within the web server process context
DevOps tooling such as Octopus Deploy, TeamCity agents, or Ansible running under an IIS-hosted application pool identity to execute deployment scripts

Splunk

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ParentImageLower=lower(ParentImage)
| eval ChildImageLower=lower(Image)
| where match(ParentImageLower, "(w3wp\.exe|httpd\.exe|nginx\.exe|apache2\.exe|java\.exe|python\.exe|python3\.exe|php\.exe|php-cgi\.exe|node\.exe|ruby\.exe|perl\.exe|tomcat[0-9]*\.exe|ews\.exe|umworkerprocess\.exe|msexchangeservicehost\.exe)")
| where match(ChildImageLower, "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe|nc\.exe|ncat\.exe|net\.exe|net1\.exe|whoami\.exe|ipconfig\.exe|systeminfo\.exe|nltest\.exe|ping\.exe|nslookup\.exe|tasklist\.exe|schtasks\.exe|at\.exe|sc\.exe|reg\.exe)")
| eval ExploitEvidence=case(
    match(ChildImageLower, "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe)"), "Shell Spawned",
    match(ChildImageLower, "(certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe|nc\.exe|ncat\.exe)"), "Download/C2 Tool",
    match(ChildImageLower, "(whoami\.exe|ipconfig\.exe|systeminfo\.exe|nltest\.exe|net\.exe|net1\.exe|tasklist\.exe)"), "Reconnaissance",
    match(ChildImageLower, "(schtasks\.exe|at\.exe|sc\.exe|reg\.exe)"), "Persistence Attempt",
    true(), "Suspicious Child"
)
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, ExploitEvidence
| sort - _time

Detects exploitation of public-facing web applications by identifying web server processes spawning suspicious child processes using Sysmon Event ID 1 (Process Creation). Monitors IIS (w3wp.exe), Apache, Nginx, Java/Tomcat, PHP, Node.js, and Microsoft Exchange worker processes for unexpected child process relationships indicative of command injection, deserialization attacks, or template injection vulnerabilities. Classifies each detection as Shell Spawned, Download/C2 Tool, Reconnaissance, or Persistence Attempt to streamline analyst triage.

critical severity high confidence

Data Sources

Process: Process Creation Sysmon Event ID 1

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

Legitimate web application frameworks that invoke system utilities as part of normal operation — e.g., Node.js applications using child_process.exec() for image processing, PDF generation, or video transcoding
Application deployment automation where IIS app pools or Java application servers execute build tools, packaging scripts, or health check commands as part of CI/CD pipelines
Exchange Hybrid Configuration Wizard and other Microsoft management tools that run Exchange worker processes spawning PowerShell for legitimate configuration and maintenance tasks
Application Performance Monitoring (APM) and diagnostic agents (Dynatrace, AppDynamics, New Relic) that fork child processes for JVM or CLR diagnostics from within the web server process context
DevOps tooling such as Octopus Deploy, TeamCity agents, or Ansible running under an IIS-hosted application pool identity to execute deployment scripts

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  LOGSOURCETYPENAME(logsourceid) AS LogSourceType,
  sourceip,
  username,
  "ParentProcessName",
  "ProcessName",
  "CommandLine",
  "ParentCommandLine",
  CATEGORYNAME(category) AS Category,
  CASE
    WHEN LOWER("ProcessName") SIMILAR TO '%(cmd.exe|powershell.exe|pwsh.exe|wscript.exe|cscript.exe|mshta.exe)%' THEN 'Shell Spawned'
    WHEN LOWER("ProcessName") SIMILAR TO '%(certutil.exe|bitsadmin.exe|curl.exe|wget.exe|nc.exe|ncat.exe)%' THEN 'Download/C2 Tool'
    WHEN LOWER("ProcessName") SIMILAR TO '%(whoami.exe|ipconfig.exe|systeminfo.exe|nltest.exe|net.exe|net1.exe|tasklist.exe|quser.exe)%' THEN 'Reconnaissance'
    WHEN LOWER("ProcessName") SIMILAR TO '%(schtasks.exe|at.exe|sc.exe|reg.exe)%' THEN 'Persistence Attempt'
    ELSE 'Suspicious Child'
  END AS ExploitEvidence
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Security Event Log', 'Snare for Windows')
  AND (
    LOWER("ParentProcessName") SIMILAR TO '%(w3wp.exe|httpd.exe|nginx.exe|apache2.exe|java.exe|python.exe|python3.exe|php.exe|php-cgi.exe|node.exe|ruby.exe|perl.exe|tomcat%.exe|ews.exe|umworkerprocess.exe|msexchangeservicehost.exe)%'
  )
  AND (
    LOWER("ProcessName") SIMILAR TO '%(cmd.exe|powershell.exe|pwsh.exe|wscript.exe|cscript.exe|mshta.exe|rundll32.exe|regsvr32.exe|certutil.exe|bitsadmin.exe|curl.exe|wget.exe|nc.exe|ncat.exe|net.exe|net1.exe|whoami.exe|ipconfig.exe|systeminfo.exe|nltest.exe|ping.exe|nslookup.exe|tasklist.exe|quser.exe|schtasks.exe|at.exe|sc.exe|reg.exe)%'
  )
ORDER BY devicetime DESC
LAST 24 HOURS

QRadar AQL query targeting Windows Security Event Log sources to detect web server and application runtime processes spawning suspicious child processes. Uses custom event properties for ParentProcessName, ProcessName, and CommandLine as populated by DSM parsing of Windows Event ID 4688 or Sysmon Event ID 1. Classifies each match by exploitation stage.

high severity medium confidence

Data Sources

Microsoft Windows Security Event Log Sysmon via Snare/WinCollect IBM QRadar WinCollect

Required Tables

events

False Positives

Automated deployment pipelines or CI/CD agents running inside IIS or Tomcat application pools that legitimately invoke cmd.exe or PowerShell for configuration management tasks
Vulnerability scanners or EDR agents performing authenticated system enumeration (whoami, systeminfo) from within monitored web application processes
Java-based enterprise applications (e.g., Jenkins, Confluence) that shell out to system utilities as part of plugin execution or administrative operations

Sumo Logic CSE

sql

(_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*winlogbeat*)
| where EventID = "1" or EventCode = "1"
| parse field=ParentImage "*\\*" as _throwaway, ParentProcessName nocase
| parse field=Image "*\\*" as _throwaway2, ChildProcessName nocase
| where ParentProcessName matches /(?i)^(w3wp\.exe|httpd\.exe|nginx\.exe|apache2\.exe|java\.exe|python\.exe|python3\.exe|php\.exe|php-cgi\.exe|node\.exe|ruby\.exe|perl\.exe|tomcat[0-9]*\.exe|ews\.exe|umworkerprocess\.exe|msexchangeservicehost\.exe)$/
| where ChildProcessName matches /(?i)^(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe|nc\.exe|ncat\.exe|net\.exe|net1\.exe|whoami\.exe|ipconfig\.exe|systeminfo\.exe|nltest\.exe|ping\.exe|nslookup\.exe|tasklist\.exe|quser\.exe|schtasks\.exe|at\.exe|sc\.exe|reg\.exe)$/
| if (ChildProcessName matches /(?i)^(cmd|powershell|pwsh|wscript|cscript|mshta)\.exe$/, "Shell Spawned",
    if (ChildProcessName matches /(?i)^(certutil|bitsadmin|curl|wget|nc|ncat)\.exe$/, "Download/C2 Tool",
    if (ChildProcessName matches /(?i)^(whoami|ipconfig|systeminfo|nltest|net|net1|tasklist|quser)\.exe$/, "Reconnaissance",
    if (ChildProcessName matches /(?i)^(schtasks|at|sc|reg)\.exe$/, "Persistence Attempt", "Suspicious Child")))) as ExploitEvidence
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, ExploitEvidence
| sort by _messageTime desc

Sumo Logic query against Windows Sysmon Event ID 1 (Process Create) logs to identify web server and application runtime parent processes that spawn known post-exploitation child processes. Extracts process names from full image paths and classifies detections by exploitation stage for triage prioritization.

high severity high confidence

Data Sources

Sysmon via Windows Event Log collection Winlogbeat forwarded to Sumo Logic Sumo Logic Installed Collector on Windows hosts

Required Tables

_sourceCategory=*windows* _sourceCategory=*sysmon*

False Positives

Legitimate application health check scripts that run under IIS worker process (w3wp.exe) context invoking ping.exe or nslookup.exe to verify network connectivity
Java application servers (Tomcat, JBoss) invoking net.exe or sc.exe as part of Windows service lifecycle management or cluster coordination
Python or Ruby web applications using subprocess calls to run system commands for legitimate data processing or integration with legacy CLI tools

Google Chronicle / SecOps

yaral

rule t1190_exploit_public_facing_application {
  meta:
    author = "Detection Engineering"
    description = "Detects web server and application runtime processes spawning suspicious child processes indicative of public-facing application exploitation (T1190)"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "T1190"
    mitre_attack_technique_id = "T1190"
    severity = "HIGH"
    confidence = "HIGH"
    platform = "Windows"
    reference = "https://attack.mitre.org/techniques/T1190/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /(?i)(w3wp\.exe|httpd\.exe|nginx\.exe|apache2\.exe|java\.exe|python\.exe|python3\.exe|php\.exe|php-cgi\.exe|node\.exe|ruby\.exe|perl\.exe|tomcat[0-9]*\.exe|ews\.exe|umworkerprocess\.exe|msexchangeservicehost\.exe)$/
    $e.target.process.file.full_path = /(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe|nc\.exe|ncat\.exe|net\.exe|net1\.exe|whoami\.exe|ipconfig\.exe|systeminfo\.exe|nltest\.exe|ping\.exe|nslookup\.exe|tasklist\.exe|quser\.exe|schtasks\.exe|at\.exe|sc\.exe|reg\.exe)$/
    $e.principal.hostname = $hostname
    $e.principal.user.userid = $user

  condition:
    $e
}

Chronicle YARA-L 2.0 rule using UDM process launch events to match web server parent processes (IIS, Apache, Nginx, Tomcat, Exchange, scripting runtimes) that spawn post-exploitation tooling. Leverages principal.process for the parent and target.process for the spawned child, consistent with Chronicle's UDM PROCESS_LAUNCH event model.

high severity high confidence

Data Sources

Chronicle UDM via Google Workspace/GCP log ingestion Chronicle forwarder with Windows Event Log or Sysmon collection Third-party EDR UDM feeds

Required Tables

UDM events (PROCESS_LAUNCH type)

False Positives

Managed web hosting environments where IIS application pools execute scheduled tasks (schtasks.exe, at.exe) as part of CMS or e-commerce platform maintenance routines
Java-based middleware platforms that use ProcessBuilder or Runtime.exec() to invoke net.exe or sc.exe for Windows service management as part of startup/shutdown hooks
Security scanners or endpoint agents legitimately invoking whoami.exe or systeminfo.exe from application contexts to collect telemetry or verify runtime identity

CrowdStrike LogScale (CQL)

cql

#event_simpleName=ProcessRollup2
| ParentBaseFileName = /(?i)^(w3wp|httpd|nginx|apache2|java|python|python3|php|php-cgi|node|ruby|perl|tomcat[0-9]*|ews|umworkerprocess|msexchangeservicehost)\.exe$/
| FileName = /(?i)^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|curl|wget|nc|ncat|net|net1|whoami|ipconfig|systeminfo|nltest|ping|nslookup|tasklist|quser|schtasks|at|sc|reg)\.exe$/
| ExploitEvidence := case {
    FileName = /(?i)^(cmd|powershell|pwsh|wscript|cscript|mshta)\.exe$/ => "Shell Spawned";
    FileName = /(?i)^(certutil|bitsadmin|curl|wget|nc|ncat)\.exe$/ => "Download/C2 Tool";
    FileName = /(?i)^(whoami|ipconfig|systeminfo|nltest|net|net1|tasklist|quser)\.exe$/ => "Reconnaissance";
    FileName = /(?i)^(schtasks|at|sc|reg)\.exe$/ => "Persistence Attempt";
    * => "Suspicious Child"
  }
| table([timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ParentCommandLine, ExploitEvidence, SHA256HashData, TargetProcessId, ContextProcessId])
| sort(timestamp, order=desc)

CrowdStrike LogScale (Humio) CQL query targeting ProcessRollup2 events from the Falcon sensor to detect exploitation of public-facing applications. Matches web server and application runtime parent processes spawning post-exploitation binaries, classifying each by exploitation stage. Uses ParentBaseFileName and FileName fields native to Falcon telemetry.

high severity high confidence

Data Sources

CrowdStrike Falcon Sensor (ProcessRollup2 events) Falcon Data Replicator (FDR) streamed to LogScale

Required Tables

#event_simpleName=ProcessRollup2

False Positives

Legitimate use of Python or Node.js web servers in developer environments where the runtime spawns shell commands during build, test, or scaffolding operations
Enterprise Java applications (e.g., JIRA, Confluence, Jenkins) that use Runtime.exec() to invoke net.exe, sc.exe, or ping.exe for service discovery, cluster health checks, or Windows-specific integrations
IIS-hosted applications with custom HTTP modules or ISAPI filters that invoke certutil.exe or reg.exe during certificate renewal workflows or registry-backed configuration updates

Sigma rule & cross-platform mapping

The detection logic for Exploit Public-Facing Application (T1190) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1190 Sigma rules on detection.fyi

Platform-specific guides for T1190

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-19 Research depth: deep

References (8)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Web Server Process Spawning Reconnaissance Commands
Expected signal: Sysmon Event ID 1: Process Create events for cmd.exe, whoami.exe, ipconfig.exe, net.exe, systeminfo.exe with respective command lines. Security Event ID 4688 (with command line auditing enabled) for each spawned process. Sysmon Event ID 11: File creation at %TEMP%\argus-t1190-recon.txt.
Test 2Drop Test Webshell File in IIS Web Root
Expected signal: Sysmon Event ID 11: File Create with TargetFilename='C:\inetpub\wwwroot\argus-test-shell.aspx'. Sysmon Event ID 1: Process Create for powershell.exe with Set-Content command visible in CommandLine. DeviceFileEvents in Microsoft Defender for Endpoint will show the .aspx file creation with the initiating process context.
Test 3Log4Shell JNDI Lookup Payload in HTTP Request Headers
Expected signal: Web server access log entry (Apache: /var/log/apache2/access.log, Nginx: /var/log/nginx/access.log) showing the JNDI payload strings in User-Agent and custom header fields. If a Java application with Log4j is running on port 80, Sysmon EventCode=3 (or /proc/net/tcp) will show an LDAP connection attempt to 127.0.0.1:1389 from the java.exe/java process.
Test 4SQL Injection Payloads in Web Application Query Parameters
Expected signal: Web server access logs will contain entries with SQL injection strings in the cs-uri-query field (IIS) or request URI (Apache/Nginx). The HTTP response codes (200, 400, 404, 500) are printed to stdout for each payload. WAF alert events generated if a WAF is in the request path. No database query is executed — the payloads are evaluated only at the HTTP layer.

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1190 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Exploit Public-Facing Application

What is T1190 Exploit Public-Facing Application?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1190

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Initial Access

Popular Detections

What is T1190 Exploit Public-Facing Application?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1190

Testing Methodology

Unlock Pro Content

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox