Exploitation of Remote Services `T0866`

ICS Tactics: Initial Access, Lateral Movement

Authoring guide

These 5 rules share fields, values, and exclusions.

Fields filtered most (5 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`module_s`	3	`eq` 3	`IDS`
`title_s`	3	`eq` 3	`Exploitation Attempt`, `Scanner Activity`, `Suspicious Connection`
`DeviceProduct`	1	`eq` 1	`iSID`
`EventClassID`	1	`in` 1	`179`, `34`, `53`
`EventMessage`	1	`contains` 1	`Exploit`

Top indicator values (14 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`module_s`	`eq`	`IDS` kustoCynerio - Exploitation Attempt of IoT device kustoCynerio - Medical device scanning kustoCynerio - Suspicious Connection to External Address	3	5
`DeviceProduct`	`eq`	`iSID` kustoRadiflow - Exploit Detected	1	8
`EventClassID`	`in`	`179` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`34` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`53` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`67` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`68` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`69` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`70` kustoRadiflow - Exploit Detected	1
`EventClassID`	`in`	`71` kustoRadiflow - Exploit Detected	1
`EventMessage`	`contains`	`Exploit` kustoRadiflow - Exploit Detected	1
`title_s`	`eq`	`Exploitation Attempt` kustoCynerio - Exploitation Attempt of IoT device	1
`title_s`	`eq`	`Scanner Activity` kustoCynerio - Medical device scanning	1
`title_s`	`eq`	`Suspicious Connection` kustoCynerio - Suspicious Connection to External Address	1

Rules under this technique

These vendors publish rules tagged with this technique.

Kusto 5 rules