Exploit Public-Facing Application `T0819`

ICS Tactic: Initial Access

Authoring guide

These 3 rules share fields, values, and exclusions.

Fields filtered most (9 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`Active`	1	`eq` 1	`true`
`DataverseActivity_TimeGenerated`	1	`cross_field_compare` 1	`ExpirationDateTime`
`DeviceProduct`	1	`eq` 1	`isid`
`EventClassID`	1	`in` 1	`179`, `34`, `53`
`EventMessage`	1	`contains` 1	`exploit`
`Fields`	1	`contains` 1, `is_not_null` 1	`http`
`Message`	1	`in` 1	`Create`, `Update`
`Url`	1	`is_not_null` 1
`aws::userAgent`	1	`contains` 1, `is_not_null` 1	`blink`, `edgehtml`, `gecko`

Top indicator values (21 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`Active`	`eq`	`true` kustoDataverse - TI map URL to DataverseActivity	1	70
`DataverseActivity_TimeGenerated`	`cross_field_compare`	`ExpirationDateTime` kustoDataverse - TI map URL to DataverseActivity	1	2
`DeviceProduct`	`eq`	`isid` kustoRadiflow - Exploit Detected	1	8
`EventClassID`	`in`	`179` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`34` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`53` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`67` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`68` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`69` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`70` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`71` kustoRadiflow - Exploit Detected	1
`EventMessage`	`contains`	`exploit` kustoRadiflow - Exploit Detected	1
`Fields`	`contains`	`http` kustoDataverse - TI map URL to DataverseActivity	1
`Message`	`in`	`Create` kustoDataverse - TI map URL to DataverseActivity	1	2
`Message`	`in`	`Update` kustoDataverse - TI map URL to DataverseActivity	1	2
`aws::userAgent`	`contains`	`blink` kustoDataverse - New user agent type that was not used before	1
`aws::userAgent`	`contains`	`edgehtml` kustoDataverse - New user agent type that was not used before	1
`aws::userAgent`	`contains`	`gecko` kustoDataverse - New user agent type that was not used before	1
`aws::userAgent`	`contains`	`presto` kustoDataverse - New user agent type that was not used before	1
`aws::userAgent`	`contains`	`trident` kustoDataverse - New user agent type that was not used before	1
`aws::userAgent`	`contains`	`webkit` kustoDataverse - New user agent type that was not used before	1

Exclusions (12 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userAgent`	`contains`	`blink` kustoDataverse - New user agent type that was not used before	1
`aws::userAgent`	`contains`	`edgehtml` kustoDataverse - New user agent type that was not used before	1
`aws::userAgent`	`contains`	`gecko` kustoDataverse - New user agent type that was not used before	1
`aws::userAgent`	`contains`	`presto` kustoDataverse - New user agent type that was not used before	1
`aws::userAgent`	`contains`	`trident` kustoDataverse - New user agent type that was not used before	1
`aws::userAgent`	`contains`	`webkit` kustoDataverse - New user agent type that was not used before	1
`aws::userAgent`	`eq`	`[]` kustoDataverse - New user agent type that was not used before	1
`aws::userAgent`	`starts_with`	`PowerApps` kustoDataverse - New user agent type that was not used before	1
`aws::userAgent`	`starts_with`	`azure-logic-apps` kustoDataverse - New user agent type that was not used before	1
`user`	`contains`	`@microsoft.com` kustoDataverse - New user agent type that was not used before	1
`user`	`contains`	`@onmicrosoft.com` kustoDataverse - New user agent type that was not used before	1
`user`	`contains`	`unknown` kustoDataverse - New user agent type that was not used before	1

Rules under this technique

These vendors publish rules tagged with this technique.