Exploit Public-Facing Application `T0819`

ICS Tactic: Initial Access

Authoring guide

These 3 rules share fields, values, and exclusions.

Fields filtered most (4 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`Active`	1	`eq` 1	`true`
`DeviceProduct`	1	`eq` 1	`iSID`
`EventClassID`	1	`in` 1	`179`, `34`, `53`
`EventMessage`	1	`contains` 1	`Exploit`

Top indicator values (11 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`Active`	`eq`	`true` kustoDataverse - TI map URL to DataverseActivity	1	60
`DeviceProduct`	`eq`	`iSID` kustoRadiflow - Exploit Detected	1	8
`EventClassID`	`in`	`179` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`34` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`53` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`67` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`68` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`69` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`70` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`71` kustoRadiflow - Exploit Detected	1
`EventMessage`	`contains`	`Exploit` kustoRadiflow - Exploit Detected	1

Rules under this technique

These vendors publish rules tagged with this technique.

Kusto 3 rules