Exploitation of Remote Services T0866

Authoring guide

These 5 rules share fields, values, and exclusions.

Fields filtered most (6 distinct)

These fields appear most often in rule filters.

Top indicator values (20 distinct)

These values appear most often in rule predicates.

Exclusions (12 distinct)

These values appear most often in top-level exclusions.

Rules under this technique

These vendors publish rules tagged with this technique.

Kusto 5 rules

• Cynerio - Exploitation Attempt of IoT device
• Cynerio - Medical device scanning
• Cynerio - Suspicious Connection to External Address
• Dataverse - New user agent type that was not used before
• Radiflow - Exploit Detected