T1190 — Exploit Public-Facing Application

Tactic: Initial Access · Platforms: Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like…

Sigma detection rules (7)

title: T1190 Exploit Public-Facing Application
id: c3b7721f-de8e-49a5-92e1-8b3d8c1b8ea8
description: 'Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress). (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: PublicVIPs, SuspiciousPatterns, ErrorRateThreshold, TimeWindow, AllowedChildList.'
references:
  - https://attack.mitre.org/techniques/T1190
author: Shahrukh Khan
date: 2026-01-28
license: MIT
tags:
  - attack.initial-access
  - attack.t1190

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\tomcat.exe'
      - '\java.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'

  condition: selection

falsepositives:
  - Legitimate web-application functionality that intentionally shells out (rare and usually a code smell in itself); very low false-positive rate in most environments.

level: critical

title: T1190 Exploit Public-Facing Application
id: 3295371a-d8c5-4f24-8e38-0bc13a35bfb2
description: 'Exploit Public-Facing Application - detects a shell/interpreter process being execed without ever passing through an interactive login, a pattern consistent with a public-facing service (web server, database engine, management protocol daemon) being exploited and spawning a command shell. The prior rule required exe to end with nginx/httpd/apache2/java AND a0 to end with bash/sh/python3/perl within the same EXECVE record - but exe and a0 both describe the single program actually being execed in that record, so they can never legitimately hold two different program names simultaneously; the rule could not fire as designed. Retargeted to auid (loginuid): auditd sets this to the sentinel value 4294967295 ("unset") for any process descended from a non-interactively-authenticated context such as a systemd-managed service, so a shell/interpreter execve where auid is still unset is consistent with a service process spawning a shell without ever going through login - without requiring PPID-to-parent-image correlation that a single auditd record cannot provide. Tune using: ChildToolList, BurstThreshold, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1190
author: Shahrukh Khan
date: 2026-02-04
license: MIT
tags:
  - attack.initial-access
  - attack.t1190

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_shell_exec:
    type: EXECVE
    exe|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/python3'
      - '/perl'
      - '/nc'
  selection_no_login_session:
    auid: '4294967295'

  condition: selection_shell_exec and selection_no_login_session

falsepositives:
  - Containers, systemd services, cron/timers, and other non-interactive automation also legitimately exec shells with auid unset; scope further with ppid/exe allow-listing of your known web-facing daemons where your SIEM enriches auditd with process-tree/parent-image data.

level: high

title: T1190 Exploit Public-Facing Application
id: 9b7f7637-d49f-44ee-a907-8789a0e6a1a8
description: 'Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ServiceList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1190
author: Shahrukh Khan
date: 2026-02-27
license: MIT
tags:
  - attack.initial-access
  - attack.t1190

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|contains:
      - '/httpd'
      - '/nginx'
    Image|endswith:
      - '/bash'
      - '/sh'

  condition: selection

falsepositives:
  - CGI scripts or legitimate web-server automation spawning shells for approved server-side tasks.

level: high

title: T1190 Exploit Public-Facing Application
id: 224db040-d250-488d-a93d-5bda3d71d4b9
description: 'Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress). (Retargeted to the webserver AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LBProjects, ErrorBurst.'
references:
  - https://attack.mitre.org/techniques/T1190
author: Shahrukh Khan
date: 2026-02-14
license: MIT
tags:
  - attack.initial-access
  - attack.t1190

logsource:
  category: webserver
  product: alb

detection:
  selection_error_burst:
    elb_status_code:
      - '500'
      - '502'
      - '503'
  selection_payload_indicators:
    request_url|contains:
      - '../../'
      - '<script'
      - 'UNION SELECT'
      - 'jndi:ldap'

  condition: selection_payload_indicators or selection_error_burst

falsepositives:
  - Application bugs and misconfigured health checks can generate 5xx bursts unrelated to exploitation, and vulnerability scanning by the security team itself will match the payload patterns, so this is a low-confidence signal without web application firewall correlation.

level: medium

title: T1190 Exploit Public-Facing Application
id: 66c2d0d3-bcd8-4885-baa9-778d7441d40b
description: 'Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress). (Data Component: Application Log Content; baseline tier: fallback.) Tune using: MgmtPorts, TrustedAdmins.'
references:
  - https://attack.mitre.org/techniques/T1190
author: Shahrukh Khan
date: 2026-04-03
license: MIT
tags:
  - attack.initial-access
  - attack.t1190

logsource:
  product: networkdevice
  service: controlplane

detection:
  selection_extmgmt:
    Message|contains:
      - 'management interface'
      - 'HTTP'
  selection_exploit:
    Message|contains:
      - '../../'
      - '%00'
      - 'union select'
  condition: selection_extmgmt and selection_exploit

falsepositives:
  - Authorized vulnerability scanning of the management interface performed by the internal security team will also match this pattern.

level: critical

title: T1190 Exploit Public-Facing Application
id: 4090483f-91ee-4e12-bc41-e24cb62ff4d7
description: 'Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress). (Data Component: Application Log Content; baseline tier: fallback.) Tune using: IngressNamespaces, MetadataEndpoints, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1190
author: Shahrukh Khan
date: 2026-06-10
license: MIT
tags:
  - attack.initial-access
  - attack.t1190

logsource:
  product: applicationlog
  service: ingress

detection:
  selection_payload:
    request|contains:
      - '../'
      - 'union select'
      - '/etc/passwd'
      - 'jndi:ldap'
      - '<script'
  selection_anomaly:
    status:
      - 500
      - 502
      - 403

  condition: selection_payload and selection_anomaly

falsepositives:
  - Vulnerability scanners and penetration tests generating malicious-looking requests against the ingress endpoint.

level: medium

title: T1190 Exploit Public-Facing Application
id: 3611a4fe-11dc-4deb-a76c-235b64711997
description: 'Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress). (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MgmtCIDR, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1190
author: Shahrukh Khan
date: 2026-01-07
license: MIT
tags:
  - attack.initial-access
  - attack.t1190

logsource:
  product: esxi
  service: vpxd

detection:
  selection:
    Message|contains:
      - 'unexpected'
      - 'crashed'
      - 'core dump'
  selection_service:
    Message|contains:
      - 'rhttpproxy'
      - 'slpd'
      - 'sfcbd'
      - 'vpxa'

  condition: selection and selection_service

falsepositives:
  - Benign service restarts caused by resource exhaustion, patching, or an ESXi upgrade rather than exploitation; vpxd.log cannot capture the raw exploit payload, only the resulting service instability, so confirmation requires a network-side IDS signature.

level: high

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1190 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan