T1190 Exploit Public-Facing Application

About this technique

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution.

If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies.

Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.

For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.

Detection rules164

Rules on DetectionCode tagged with T1190.

Sigma49

Rule	Level	Log source
Apache Spark Shell Command Injection - ProcessCreation	high	linux / process_creation
Atlassian Confluence CVE-2022-26134	high	linux / process_creation
DNS Query to External Service Interaction Domains	high	NULL / dns
Hack Tool User Agent	high	NULL / proxy
Java Payload Strings	high	NULL / webserver
JNDIExploit Pattern	high	NULL / webserver
OMIGOD HTTP No Authentication RCE	high	zeek / NULL
OMIGOD SCX RunAsProvider ExecuteScript	high	linux / process_creation
OMIGOD SCX RunAsProvider ExecuteShellCommand	high	linux / process_creation
OpenCanary - FTP Login Attempt	high	opencanary / application
OpenCanary - HTTP GET Request	high	opencanary / application
OpenCanary - HTTP POST Login Attempt	high	opencanary / application
Potential JNDI Injection Exploitation In JVM Based Application	high	jvm / application
Potential Local File Read Vulnerability In JVM Based Application	high	jvm / application
Potential OGNL Injection Exploitation In JVM Based Application	high	jvm / application
Potential RCE Exploitation Attempt In NodeJS	high	nodejs / application
Potential Server Side Template Injection In Velocity	high	velocity / application
Potential SpEL Injection In Spring Framework	high	spring / application
Potential XXE Exploitation Attempt In JVM Based Application	high	jvm / application
Process Execution Error In JVM Based Application	high	jvm / application
Remote Access Tool - ScreenConnect Server Web Shell Execution	high	windows / process_creation
SQL Injection Strings In URI	high	NULL / webserver
Suspicious Child Process Of SQL Server	high	windows / process_creation
Suspicious File Write to SharePoint Layouts Directory	high	windows / file_event
Suspicious MSExchangeMailboxReplication ASPX Write	high	windows / file_event
Suspicious Named Error	high	linux / NULL
Suspicious Process By Web Server Process	high	windows / process_creation
Suspicious Processes Spawned by WinRM	high	windows / process_creation
Suspicious SQL Error Messages	high	sql / application
Terminal Service Process Spawn	high	windows / process_creation
Apache Threading Error	medium	NULL / NULL
Django Framework Exceptions	medium	django / application
F5 BIG-IP iControl Rest API Command Execution - Proxy	medium	NULL / proxy
F5 BIG-IP iControl Rest API Command Execution - Webserver	medium	NULL / webserver
Failed Logon From Public IP	medium	windows / NULL
Ingress/Egress Security Group Modification	medium	aws / NULL
LoadBalancer Security Group Modification	medium	aws / NULL
Path Traversal Exploitation Attempts	medium	NULL / webserver
Python SQL Exceptions	medium	python / application
RDS Database Security Group Modification	medium	aws / NULL
Ruby on Rails Framework Exceptions	medium	ruby_on_rails / application
Spring Framework Exceptions	medium	spring / application
Successful IIS Shortname Fuzzing Scan	medium	NULL / webserver
Suspicious File Drop by Exchange	medium	windows / file_event
Suspicious File Write to Webapps Root Directory	medium	windows / file_event
Suspicious OpenSSH Daemon Error	medium	linux / NULL
Suspicious SQL Query	medium	NULL / database
Suspicious User-Agents Related To Recon Tools	medium	NULL / webserver
Suspicious VSFTPD Error Messages	medium	linux / NULL

Splunk115

Rule	Type	Risk	Data source
Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint	TTP	NULL	Suricata
Adobe ColdFusion Access Control Bypass	Anomaly	NULL	Suricata
Adobe ColdFusion Unauthenticated Arbitrary File Read	Anomaly	NULL	Suricata
Cisco IOS XE Implant Access	TTP	NULL	Suricata
Cisco IOS XE Request Platform Package Describe Shell Pattern	TTP	NULL	Cisco IOS Logs
Cisco IOS XE WebUI Login From IOSd Local Port	TTP	NULL	Cisco IOS Logs
Cisco IOS XE WebUI Programmatic Configuration	Anomaly	NULL	Cisco IOS Logs
Cisco NVM - Webserver Download From File Sharing Website	TTP	NULL	Cisco Network Visibility Module Flow Data
Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity	TTP	NULL	Cisco SD-WAN Service Proxy Access Logs
Cisco SD-WAN - Low Frequency Rogue Peer	Anomaly	NULL	Cisco SD-WAN NTCE 1000001
Cisco SD-WAN - Peering Activity	Hunting	NULL	Cisco SD-WAN NTCE 1000001
Cisco Secure Firewall - High Priority Intrusion Classification	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event
Cisco Secure Firewall - Lumma Stealer Activity	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event
Cisco Secure Firewall - Oracle E-Business Suite Correlation	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event
Cisco Secure Firewall - Oracle E-Business Suite Exploitation	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event
Cisco Secure Firewall - React Server Components RCE Attempt	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event
Cisco Secure Firewall - Static Tundra Smart Install Abuse	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event
Cisco Smart Install Oversized Packet Detection	TTP	NULL	Splunk Stream TCP
Cisco Smart Install Port Discovery and Status	TTP	NULL	Splunk Stream TCP
Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure	Anomaly	NULL	Suricata
Citrix ADC and Gateway Unauthorized Data Disclosure	TTP	NULL	Suricata
Citrix ADC Exploitation CVE-2023-3519	Hunting	NULL	Palo Alto Network Threat
Citrix ShareFile Exploitation CVE-2023-24489	Hunting	NULL	Suricata
Confluence CVE-2023-22515 Trigger Vulnerability	TTP	NULL	Suricata
Confluence Data Center and Server Privilege Escalation	TTP	NULL	Nginx Access
Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527	TTP	NULL	Suricata
Confluence Unauthenticated Remote Code Execution CVE-2022-26134	TTP	NULL	Palo Alto Network Threat
ConnectWise ScreenConnect Authentication Bypass	TTP	NULL	Suricata
ConnectWise ScreenConnect Path Traversal	TTP	NULL	Sysmon EventID 11
ConnectWise ScreenConnect Path Traversal Windows SACL	TTP	NULL	Windows Event Log Security 4663
CrushFTP Authentication Bypass Exploitation	TTP	NULL	CrushFTP
CrushFTP Server Side Template Injection	TTP	NULL	CrushFTP
Detect Exchange Web Shell	TTP	NULL	Sysmon EventID 11
Detect F5 TMUI RCE CVE-2020-5902	TTP	NULL
Detect Outbound LDAP Traffic	Hunting	NULL	Palo Alto Network Traffic, Cisco Secure Firewall Threat Defense Connection Event, Cisco Secure Access Firewall
Detect Zerologon via Zeek	TTP	NULL
Exchange PowerShell Abuse via SSRF	TTP	NULL
Exploit Public Facing Application via Apache Commons Text	Anomaly	NULL	Nginx Access
Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952	TTP	NULL	Palo Alto Network Threat
F5 BIG-IP iControl REST Vulnerability CVE-2022-1388	TTP	NULL	Palo Alto Network Threat
Fortinet Appliance Auth bypass	TTP	NULL	Palo Alto Network Threat
HTTP Duplicated Header	Anomaly	NULL	Suricata
HTTP Rapid POST with Mixed Status Codes	Anomaly	NULL	Nginx Access
HTTP Request to Reserved Name on IIS Server	TTP	NULL	Suricata
Hunting for Log4Shell	Hunting	NULL	Nginx Access
Ivanti Connect Secure Command Injection Attempts	TTP	NULL	Suricata
Ivanti Connect Secure SSRF in SAML Component	TTP	NULL	Suricata
Ivanti Connect Secure System Information Access via Auth Bypass	Anomaly	NULL	Suricata
Ivanti EPM SQL Injection Remote Code Execution	TTP	NULL	Suricata
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078	TTP	NULL	Suricata
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082	TTP	NULL	Suricata
Ivanti Sentry Authentication Bypass	TTP	NULL	Suricata
Ivanti VTM New Account Creation	TTP	NULL	Ivanti VTM Audit
Java Class File download by Java User Agent	TTP	NULL	Splunk Stream HTTP
Java Writing JSP File	TTP	NULL	Sysmon for Linux EventID 1 AND Sysmon for Linux EventID 11
Jenkins Arbitrary File Read CVE-2024-23897	TTP	NULL	Nginx Access
JetBrains TeamCity Authentication Bypass CVE-2024-27198	TTP	NULL	Suricata
JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198	TTP	NULL	Suricata
JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199	TTP	NULL	Suricata
JetBrains TeamCity RCE Attempt	TTP	NULL	Suricata
Juniper Networks Remote Code Execution Exploit Detection	TTP	NULL	Suricata
Linux Java Spawning Shell	TTP	NULL	Sysmon for Linux EventID 1
Linux Suspicious Child Process of PostgreSQL	TTP	NULL	Sysmon for Linux EventID 1
Linux Suspicious React or Next.js Child Process	TTP	NULL	Sysmon for Linux EventID 1
Living Off The Land Detection	Correlation	NULL
Log4Shell CVE-2021-44228 Exploitation	Correlation	NULL
Log4Shell JNDI Payload Injection Attempt	Anomaly	NULL	Nginx Access
Log4Shell JNDI Payload Injection with Outbound Connection	Anomaly	NULL	Splunk Stream IP
MOVEit Certificate Store Access Failure	Hunting	NULL
MOVEit Empty Key Fingerprint Authentication Attempt	Hunting	NULL
MS Exchange Mailbox Replication service writing Active Server Pages	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 11
Nginx ConnectWise ScreenConnect Authentication Bypass	TTP	NULL	Nginx Access
Ollama Possible RCE via Model Loading	Anomaly	NULL	Ollama Server
Ollama Suspicious Prompt Injection Jailbreak	Anomaly	NULL	Ollama Server
Outbound Network Connection from Java Using Default Ports	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 3
PaperCut NG Remote Web Access Attempt	TTP	NULL	Suricata
PaperCut NG Suspicious Behavior Debug Log	Hunting	NULL
ProxyShell ProxyNotShell Behavior Detected	Correlation	NULL
PTC Windchill Gateway Command Execution	Anomaly	NULL	Windchill Log4j
PTC Windchill GW READY OK Probe	Anomaly	NULL	Windchill Log4j
SAP NetWeaver Visual Composer Exploitation Attempt	Hunting	NULL	Suricata
Spring4Shell Payload URL Request	TTP	NULL	Nginx Access
SQL Injection with Long URLs	TTP	NULL
Suspicious Java Classes	Anomaly	NULL
Tomcat Session Deserialization Attempt	Anomaly	NULL	Nginx Access
Tomcat Session File Upload Attempt	Anomaly	NULL	Nginx Access
VMWare Aria Operations Exploit Attempt	TTP	NULL	Palo Alto Network Threat
VMware Server Side Template Injection Hunt	Hunting	NULL	Palo Alto Network Threat
VMware Workspace ONE Freemarker Server-side Template Injection	Anomaly	NULL	Palo Alto Network Threat
Web JSP Request via URL	TTP	NULL	Nginx Access
Web or Application Server Spawning a Shell	TTP	NULL	Sysmon for Linux EventID 1, Sysmon EventID 1
Web Remote ShellServlet Access	TTP	NULL	Nginx Access
Web Spring Cloud Function FunctionRouter	TTP	NULL	Splunk Stream HTTP
Web Spring4Shell HTTP Request Class Module	TTP	NULL	Splunk Stream HTTP
Windows Exchange Autodiscover SSRF Abuse	TTP	NULL	Windows IIS
Windows Identify PowerShell Web Access IIS Pool	Hunting	NULL	Windows Event Log Security 4648
Windows IIS Server PSWA Console Access	Hunting	NULL	Windows IIS
Windows Java Spawning Shells	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Metasploit Confluence Plugin Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows MOVEit Transfer Writing ASPX	TTP	NULL	Sysmon EventID 11
Windows PaperCut NG Spawn Shell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows SharePoint Spinstall0 GET Request	TTP	NULL	Suricata
Windows SharePoint Spinstall0 Webshell File Creation	TTP	NULL	Sysmon EventID 11
Windows SharePoint ToolPane Endpoint Exploitation Attempt	TTP	NULL	Suricata
Windows Shell or Script Execution From IIS Directory	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows Shell Process from CrushFTP	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Suspicious React or Next.js Child Process	TTP	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows TeamCity Payload Execution from Temp Directory	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows TeamCity Plugin Installed	Anomaly	NULL	Sysmon EventID 11
Windows Unusual File Creation in Confluence Directory	Anomaly	NULL	Sysmon EventID 11
Windows WSUS Spawning Shell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
WinRM Spawning a Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
WordPress Bricks Builder plugin RCE	TTP	NULL	Nginx Access
WS FTP Remote Code Execution	TTP	NULL	Suricata

Groups46

Show 22 more

Software8

BOLDMOVE COATHANGER Havij Qilin Siloscape SoreFang sqlmap ZxShell

Campaigns21

Procedure examples75

Groups46

Used by	Procedure example
GroupAgrius	Agrius exploits public-facing applications for initial access to victim environments. Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices and SQL injection activity. SentinelOne Agrius 2021
GroupAPT28	APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites. Cybersecurity Advisory GRU Brute Force Campaign July 2021 US District Court Indictment GRU Oct 2018
GroupAPT29	APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access. Cybersecurity Advisory SVR TTP May 2021 NCSC APT29 July 2020
GroupAPT39	APT39 has used SQL injection for initial compromise. Symantec Chafer February 2018
GroupAPT41	APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central through unsafe deserialization, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices. APT41 leveraged vulnerabilities such as ProxyLogon exploitation or SQL injection for initial access. APT41 exploited CVE-2021-26855 against a vulnerable Microsoft Exchange Server to gain initial access to the victim network. FireEye APT41 March 2020 Rostovcev APT41 2021 apt41_dcsocytec_dec2022
GroupAPT5	APT5 has exploited vulnerabilities in externally facing software and devices including Pulse Secure VPNs and Citrix Application Delivery Controllers. Mandiant Pulse Secure Update May 2021 Mandiant Pulse Secure Zero-Day April 2021 Microsoft East Asia Threats September 2023 NSA APT5 Citrix Threat Hunting December 2022
GroupAxiom	Axiom has been observed using SQL injection to gain access to systems. Cisco Group 72 Novetta-Axiom
GroupBackdoorDiplomacy	BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor. BackdoorDiplomacy has also exploited mis-configured Plesk servers. ESET BackdoorDiplomacy Jun 2021

View all 46 groups examples

Software8

Used by	Procedure example
MalwareBOLDMOVE	BOLDMOVE is associated with exploitation of CVE-2022-49475 in FortiOS. Google Cloud BOLDMOVE 2023
MalwareCOATHANGER	COATHANGER is installed following exploitation of a vulnerable FortiGate device. NCSC-NL COATHANGER Feb 2024
ToolHavij	Havij is used to automate SQL injection. Check Point Havij Analysis
MalwareQilin	Qilin has been delivered through exploitation of exposed applications and interfaces including Citrix and RDP. SentinelOne Qilin NOV 2022
MalwareSiloscape	Siloscape is executed after the attacker gains initial access to a Windows container using a known vulnerability. Unit 42 Siloscape Jun 2021
MalwareSoreFang	SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries. CISA SoreFang July 2016
Toolsqlmap	sqlmap can be used to automate exploitation of SQL injection vulnerabilities. sqlmap Introduction
MalwareZxShell	ZxShell has been dropped through exploitation of CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322. Talos ZxShell Oct 2014

Campaigns21

Used by	Procedure example
CampaignAnthropic AI-orchestrated Campaign	During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to deploy a custom exploit payload targeting an identified SSRF vulnerability to gain initial access to a targeted environment. Anthropic AI Orchestrated Campaign NOV 2025
CampaignArcaneDoor	ArcaneDoor abused WebVPN traffic to targeted devices to achieve unauthorized remote code execution. CCCS ArcaneDoor 2024
CampaignC0017	During C0017, APT41 exploited CVE-2021-44207 in the USAHerds application and CVE-2021-44228 in Log4j, as well as other .NET deserialization, SQL injection, and directory traversal vulnerabilities to gain initial access. Mandiant APT41
CampaignC0018	During C0018, the threat actors exploited VMWare Horizon Unified Access Gateways that were vulnerable to several Log4Shell vulnerabilities, including CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Cisco Talos Avos Jun 2022
CampaignC0027	During C0027, Scattered Spider exploited CVE-2021-35464 in the ForgeRock Open Access Management (OpenAM) application server to gain initial access. Crowdstrike TELCO BPO Campaign December 2022
CampaignCutting Edge	During Cutting Edge, threat actors exploited CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure VPN appliances to enable authentication bypass and command injection. A server-side request forgery (SSRF) vulnerability, CVE-2024-21893, was identified later and used to bypass mitigations for the initial two vulnerabilities by chaining with CVE-2024-21887. Mandiant Cutting Edge January 2024 Mandiant Cutting Edge Part 2 January 2024 Mandiant Cutting Edge Part 3 February 2024 Volexity Ivanti Global Exploitation January 2024 Volexity Ivanti Zero-Day Exploitation January 2024
CampaignFLORAHOX Activity	FLORAHOX Activity has exploited and infected vulnerable routers to recruit additional network devices into the ORB. ORB Mandiant
CampaignFrostyGoop Incident	FrostyGoop Incident was likely enabled by the adversary exploiting an unknown vulnerability in an external-facing router. Dragos FROSTYGOOP 2024

View all 21 campaigns examples

References11

Ars Technica VMWare Code Execution Vulnerability 2021 Open source
Dan Goodin . (2021, February 25). Code-execution flaw in VMware has a severity rating of 9.8 out of 10. Retrieved April 8, 2025.
CIS Multiple SMB Vulnerabilities Open source
CIS. (2017, May 15). Multiple Vulnerabilities in Microsoft Windows SMB Server Could Allow for Remote Code Execution. Retrieved April 3, 2018.
CWE top 25 Open source
Christey, S., Brown, M., Kirby, D., Martin, B., Paller, A.. (2011, September 13). 2011 CWE/SANS Top 25 Most Dangerous Software Errors. Retrieved April 10, 2019.
Cisco Blog Legacy Device Attacks Open source
Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.
Mandiant Fortinet Zero Day Open source
Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.
NVD CVE-2014-7169 Open source
National Vulnerability Database. (2017, September 24). CVE-2014-7169 Detail. Retrieved April 3, 2018.
NVD CVE-2016-6662 Open source
National Vulnerability Database. (2017, February 2). CVE-2016-6662 Detail. Retrieved April 3, 2018.
OWASP Top 10 Open source
OWASP. (2018, February 23). OWASP Top Ten Project. Retrieved April 3, 2018.
Recorded Future ESXiArgs Ransomware 2023 Open source
German Hoeffner, Aaron Soehnen and Gianni Perez. (2023, February 7). ESXiArgs Ransomware Targets Publicly-Exposed ESXi OpenSLP Servers. Retrieved March 26, 2025.
US-CERT TA18-106A Network Infrastructure Devices 2018 Open source
US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Wired Russia Cyberwar Open source
Greenberg, A. (2022, November 10). Russia’s New Cyberwarfare in Ukraine Is Fast, Dirty, and Relentless. Retrieved March 22, 2023.