Initial Access

T1190 — Exploit Public-Facing Application

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets...

Investigate Exploit Public-Facing Application activity in the context of Initial Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

Platforms

Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows

Priority / status

high / complete

Evidence to collect

Host or resource affected
Account or identity involved
Timestamp of the activity
Related process, file, or network artifact
Any preceding or follow-on alerts

ATT&CK Technique	D3FEND Technique	Practical SOC Action	Tooling
T1190 Exploit Public-Facing Application	User Geolocation Logon Pattern Analysis	Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique.	Defender for Endpoint
T1190 Exploit Public-Facing Application	Process Segment Execution Prevention	Apply Process Segment Execution Prevention to reduce this technique's viability before an incident occurs.	Defender for Endpoint
T1190 Exploit Public-Facing Application	Network Traffic Filtering	Apply Network Traffic Filtering to contain the blast radius once this technique is observed.	Sentinel, Defender for Endpoint

T1190 Exploit Public-Facing Application → D3FEND → SOC action

Investigation steps — Microsoft

project Timestamp, RemoteIP, RemotePort, InitiatingProcessFileName

Investigation steps — generic

Confirm whether the observed exploit public-facing application activity matches expected administrative or application behaviour.
Identify the host, account, or resource where the activity occurred and its business criticality.
Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.
Real detection reference: "Public-Facing App Webshell File Write" -- Replaces the stale March 2021 ProxyLogon IOC feed rule with a behavior-based detector for webshell-like files written under public web roots, optionally correlated with recent inbound upload/admin requests.

Response actions

Action	Risk	Automation safe	Approval required
Isolate the web server if exploitation confirmed (web server	Medium	No	Yes
Enable WAF in Prevention mode if currently in Detection mode	Low	No	Yes
Block attacking IP(s) at firewall/WAF and in Sentinel TI wat	Medium	No	Yes
Preserve web server logs before any restart or patching	Low	No	Yes
Patch the exploited vulnerability if CVE identified	Low	No	Yes
Remove any web shells found (file write query above)	Low	No	Yes
Rotate all service account passwords with access from the we	Medium	No	Yes
Check for lateral movement into internal network	Low	Yes	No

KQL

GEN-IA-008 — Public-Facing App Webshell File Write

let lookback = 1h;
let correlationWindow = 15m;
let webRoots = dynamic(["\\inetpub\\wwwroot", "\\wwwroot", "\\public_html", "\\htdocs", "\\site\\wwwroot"]);
let suspiciousExtensions = dynamic(["aspx", "ashx", "asmx", "jsp", "jspx", "php", "phtml", "pl", "py", "ps1", "cmd"]);
let suspiciousNames = dynamic(["shell", "cmd", "upload", "webadmin", "backdoor", "wso", "c99", "r57", "regeorg", "tunnel"]);
let approvedDeploymentTools = dynamic(["msdeploy.exe", "git.exe", "runner.exe", "octopus.tentacle.exe", "kudu.exe", "zipdeploy.exe"]);
let fileEventsSource =
    union isfuzzy=true DeviceFileEvents,
    (datatable(TimeGenerated:datetime, ActionType:string, DeviceId:string, DeviceName:string, FolderPath:string, FileName:string, SHA256:string, InitiatingProcessFileName:string, InitiatingProcessCommandLine:string, InitiatingProcessAccountName:string)[]);
let iisLogsSource =
    union isfuzzy=true W3CIISLog,
    (datatable(TimeGenerated:datetime, sComputerName:string, cIP:string, csMethod:string, csUriStem:string, csUserName:string, scStatus:int, csUserAgent:string)[]);
let suspiciousFileWrites =
    fileEventsSource
    | where TimeGenerated >= ago(lookback)
    | where ActionType in~ ("FileCreated", "FileModified", "FileRenamed")
    | where FolderPath has_any (webRoots)
    | extend FileExtension = tolower(tostring(split(FileName, ".")[-1])),
             FileNameLower = tolower(FileName),
             InitiatingProcessFileName = tostring(InitiatingProcessFileName)
    | where FileExtension in (suspiciousExtensions) or FileNameLower has_any (suspiciousNames)
    | where InitiatingProcessFileName !in~ (approvedDeploymentTools)
    | project WriteTime = TimeGenerated, DeviceId, DeviceName, FolderPath, FileName, FileExtension, SHA256,
              InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName;
let inboundWrites =
    iisLogsSource
    | where TimeGenerated >= ago(lookback)
    | where csMethod in~ ("POST", "PUT", "PATCH")
    | where csUriStem has_any ("/upload", "/admin", "/editor", "/api", "/wp-admin", "/owa", "/ecp")
    | project RequestTime = TimeGenerated, DeviceName = sComputerName, SrcIP = cIP, csMethod, csUriStem, csUserName, scStatus, csUserAgent;
suspiciousFileWrites
| join kind=leftouter inboundWrites on DeviceName
| where isnull(RequestTime) or abs(datetime_diff("minute", WriteTime, RequestTime)) <= toint(correlationWindow / 1m)
| extend CorrelatedInboundRequest = isnotempty(RequestTime)
| project
    TimeGenerated = coalesce(RequestTime, WriteTime),
    WriteTime,
    RequestTime,
    DeviceId,
    DeviceName,
    FolderPath,
    FileName,
    FileExtension,
    SHA256,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    InitiatingProcessAccountName,
    CorrelatedInboundRequest,
    SrcIP,
    csMethod,
    csUriStem,
    csUserName,
    scStatus,
    csUserAgent
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = InitiatingProcessAccountName,
         IPCustomEntity = SrcIP
| order by TimeGenerated desc

68c0b6bb-6bd9-4ef4-9011-08998c8ef90f — Application Gateway WAF - SQLi Detection

let Threshold = 3;
AzureDiagnostics
| where Category == "ApplicationGatewayFirewallLog"
| where action_s == "Matched"
| project transactionId_g, hostname_s, requestUri_s, TimeGenerated, clientIp_s, Message, details_message_s, details_data_s
| join kind = inner(
AzureDiagnostics
| where Category == "ApplicationGatewayFirewallLog"
| where action_s == "Blocked"
| parse Message with MessageText 'Total Inbound Score: ' TotalInboundScore ' - SQLI=' SQLI_Score ',XSS=' XSS_Score ',RFI=' RFI_Score ',LFI=' LFI_Score ',RCE=' RCE_Score ',PHPI=' PHPI_Score ',HTTP=' HTTP_Score ',SESS=' SESS_Score '): ' Blocked_Reason '; individual paranoia level scores:' Paranoia_Score
| where Blocked_Reason contains "SQL Injection Attack" and toint(SQLI_Score) >=10 and toint(TotalInboundScore) >= 15) on transactionId_g
| extend Uri = strcat(hostname_s,requestUri_s)
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g), Message = make_set(Message), Detail_Message = make_set(details_message_s), Detail_Data = make_set(details_data_s), Total_TransactionId = dcount(transactionId_g) by clientIp_s, Uri, action_s, SQLI_Score, TotalInboundScore
| where Total_TransactionId >= Threshold

d0c82b7f-40b2-4180-a4d6-7aa0541b7599 — PulseConnectSecure - CVE-2021-22893 Possible Pulse Connect Secure RCE Vulnerability Attack

let threshold = 3;
PulseConnectSecure
| where Messages contains "Unauthenticated request url /dana-na/"
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Source_IP
| where count_ > threshold

Escalation criteria

Exploit Public-Facing Application activity observed on a privileged account or critical system.
Activity follows or precedes other suspicious behaviour in the same investigation.
Automated triage cannot confidently rule out malicious intent.

False positive considerations

Authorised penetration test — Suppress WAF detection blocks during confirmed pentest window
Legitimate automation using curl/wget — Exclude specific signed management processes

View Markdown Download Markdown

# T1190 - Exploit Public-Facing Application

## SOC Recommendation
Investigate Exploit Public-Facing Application activity in the context of Initial Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| User Geolocation Logon Pattern Analysis | Detect | Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique. |
| Process Segment Execution Prevention | Harden | Apply Process Segment Execution Prevention to reduce this technique's viability before an incident occurs. |
| Network Traffic Filtering | Isolate | Apply Network Traffic Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. project Timestamp, RemoteIP, RemotePort, InitiatingProcessFileName

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Isolate the web server if exploitation confirmed (web server | Medium | No | Yes |
| Enable WAF in Prevention mode if currently in Detection mode | Low | No | Yes |
| Block attacking IP(s) at firewall/WAF and in Sentinel TI wat | Medium | No | Yes |
| Preserve web server logs before any restart or patching | Low | No | Yes |
| Patch the exploited vulnerability if CVE identified | Low | No | Yes |
| Remove any web shells found (file write query above) | Low | No | Yes |
| Rotate all service account passwords with access from the we | Medium | No | Yes |
| Check for lateral movement into internal network | Low | Yes | No |

## KQL
```kql
let lookback = 1h;
let correlationWindow = 15m;
let webRoots = dynamic(["\\inetpub\\wwwroot", "\\wwwroot", "\\public_html", "\\htdocs", "\\site\\wwwroot"]);
let suspiciousExtensions = dynamic(["aspx", "ashx", "asmx", "jsp", "jspx", "php", "phtml", "pl", "py", "ps1", "cmd"]);
let suspiciousNames = dynamic(["shell", "cmd", "upload", "webadmin", "backdoor", "wso", "c99", "r57", "regeorg", "tunnel"]);
let approvedDeploymentTools = dynamic(["msdeploy.exe", "git.exe", "runner.exe", "octopus.tentacle.exe", "kudu.exe", "zipdeploy.exe"]);
let fileEventsSource =
    union isfuzzy=true DeviceFileEvents,
    (datatable(TimeGenerated:datetime, ActionType:string, DeviceId:string, DeviceName:string, FolderPath:string, FileName:string, SHA256:string, InitiatingProcessFileName:string, InitiatingProcessCommandLine:string, InitiatingProcessAccountName:string)[]);
let iisLogsSource =
    union isfuzzy=true W3CIISLog,
    (datatable(TimeGenerated:datetime, sComputerName:string, cIP:string, csMethod:string, csUriStem:string, csUserName:string, scStatus:int, csUserAgent:string)[]);
let suspiciousFileWrites =
    fileEventsSource
    | where TimeGenerated >= ago(lookback)
    | where ActionType in~ ("FileCreated", "FileModified", "FileRenamed")
    | where FolderPath has_any (webRoots)
    | extend FileExtension = tolower(tostring(split(FileName, ".")[-1])),
             FileNameLower = tolower(FileName),
             InitiatingProcessFileName = tostring(InitiatingProcessFileName)
    | where FileExtension in (suspiciousExtensions) or FileNameLower has_any (suspiciousNames)
    | where InitiatingProcessFileName !in~ (approvedDeploymentTools)
    | project WriteTime = TimeGenerated, DeviceId, DeviceName, FolderPath, FileName, FileExtension, SHA256,
              InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName;
let inboundWrites =
    iisLogsSource
    | where TimeGenerated >= ago(lookback)
    | where csMethod in~ ("POST", "PUT", "PATCH")
    | where csUriStem has_any ("/upload", "/admin", "/editor", "/api", "/wp-admin", "/owa", "/ecp")
    | project RequestTime = TimeGenerated, DeviceName = sComputerName, SrcIP = cIP, csMethod, csUriStem, csUserName, scStatus, csUserAgent;
suspiciousFileWrites
| join kind=leftouter inboundWrites on DeviceName
| where isnull(RequestTime) or abs(datetime_diff("minute", WriteTime, RequestTime)) <= toint(correlationWindow / 1m)
| extend CorrelatedInboundRequest = isnotempty(RequestTime)
| project
    TimeGenerated = coalesce(RequestTime, WriteTime),
    WriteTime,
    RequestTime,
    DeviceId,
    DeviceName,
    FolderPath,
    FileName,
    FileExtension,
    SHA256,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    InitiatingProcessAccountName,
    CorrelatedInboundRequest,
    SrcIP,
    csMethod,
    csUriStem,
    csUserName,
    scStatus,
    csUserAgent
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = InitiatingProcessAccountName,
         IPCustomEntity = SrcIP
| order by TimeGenerated desc
```
```kql
let Threshold = 3;
AzureDiagnostics
| where Category == "ApplicationGatewayFirewallLog"
| where action_s == "Matched"
| project transactionId_g, hostname_s, requestUri_s, TimeGenerated, clientIp_s, Message, details_message_s, details_data_s
| join kind = inner(
AzureDiagnostics
| where Category == "ApplicationGatewayFirewallLog"
| where action_s == "Blocked"
| parse Message with MessageText 'Total Inbound Score: ' TotalInboundScore ' - SQLI=' SQLI_Score ',XSS=' XSS_Score ',RFI=' RFI_Score ',LFI=' LFI_Score ',RCE=' RCE_Score ',PHPI=' PHPI_Score ',HTTP=' HTTP_Score ',SESS=' SESS_Score '): ' Blocked_Reason '; individual paranoia level scores:' Paranoia_Score
| where Blocked_Reason contains "SQL Injection Attack" and toint(SQLI_Score) >=10 and toint(TotalInboundScore) >= 15) on transactionId_g
| extend Uri = strcat(hostname_s,requestUri_s)
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g), Message = make_set(Message), Detail_Message = make_set(details_message_s), Detail_Data = make_set(details_data_s), Total_TransactionId = dcount(transactionId_g) by clientIp_s, Uri, action_s, SQLI_Score, TotalInboundScore
| where Total_TransactionId >= Threshold
```
```kql
let threshold = 3;
PulseConnectSecure
| where Messages contains "Unauthenticated request url /dana-na/"
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Source_IP
| where count_ > threshold
```

## Escalation Criteria
- Exploit Public-Facing Application activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Authorised penetration test — Suppress WAF detection blocks during confirmed pentest window
- Legitimate automation using curl/wget — Exclude specific signed management processes

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1190.json

Response:

{
  "technique_id": "T1190",
  "name": "Exploit Public-Facing Application",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Initial Access"
  ],
  "platforms": [
    "Containers",
    "ESXi",
    "IaaS",
    "Linux",
    "macOS",
    "Network Devices",
    "Windows"
  ],
  "summary": "Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets...",
  "soc_recommendation": "Investigate Exploit Public-Facing Application activity in the context of Initial Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-UGLPA",
      "name": "User Geolocation Logon Pattern Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-PSEP",
      "name": "Process Segment Execution Prevention",
      "relationship": "harden",
      "practical_action": "Apply Process Segment Execution Prevention to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-NTF",
      "name": "Network Traffic Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Network Traffic Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "project Timestamp, RemoteIP, RemotePort, InitiatingProcessFileName"
    ],
    "generic": [
      "Confirm whether the observed exploit public-facing application activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Public-Facing App Webshell File Write\" -- Replaces the stale March 2021 ProxyLogon IOC feed rule with a behavior-based detector for webshell-like files written under public web roots, optionally correlated with recent inbound upload/admin requests."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Isolate the web server if exploitation confirmed (web server",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Isolate the web server if exploitation confirmed (web server spawning shells)"
    },
    {
      "name": "Enable WAF in Prevention mode if currently in Detection mode",
      "category": "Containment",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Block attacking IP(s) at firewall/WAF and in Sentinel TI wat",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Sentinel",
      "notes": "Block attacking IP(s) at firewall/WAF and in Sentinel TI watchlist"
    },
    {
      "name": "Preserve web server logs before any restart or patching",
      "category": "Containment",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Patch the exploited vulnerability if CVE identified",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Remove any web shells found (file write query above)",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Rotate all service account passwords with access from the we",
      "category": "Eradication",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Rotate all service account passwords with access from the web server"
    },
    {
      "name": "Check for lateral movement into internal network",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-IA-008 — Public-Facing App Webshell File Write",
        "description": "Replaces the stale March 2021 ProxyLogon IOC feed rule with a behavior-based detector for webshell-like files written under public web roots, optionally correlated with recent inbound upload/admin requests. (Source: Bell Integration baseline detection library.)",
        "query": "let lookback = 1h;\nlet correlationWindow = 15m;\nlet webRoots = dynamic([\"\\\\inetpub\\\\wwwroot\", \"\\\\wwwroot\", \"\\\\public_html\", \"\\\\htdocs\", \"\\\\site\\\\wwwroot\"]);\nlet suspiciousExtensions = dynamic([\"aspx\", \"ashx\", \"asmx\", \"jsp\", \"jspx\", \"php\", \"phtml\", \"pl\", \"py\", \"ps1\", \"cmd\"]);\nlet suspiciousNames = dynamic([\"shell\", \"cmd\", \"upload\", \"webadmin\", \"backdoor\", \"wso\", \"c99\", \"r57\", \"regeorg\", \"tunnel\"]);\nlet approvedDeploymentTools = dynamic([\"msdeploy.exe\", \"git.exe\", \"runner.exe\", \"octopus.tentacle.exe\", \"kudu.exe\", \"zipdeploy.exe\"]);\nlet fileEventsSource =\n    union isfuzzy=true DeviceFileEvents,\n    (datatable(TimeGenerated:datetime, ActionType:string, DeviceId:string, DeviceName:string, FolderPath:string, FileName:string, SHA256:string, InitiatingProcessFileName:string, InitiatingProcessCommandLine:string, InitiatingProcessAccountName:string)[]);\nlet iisLogsSource =\n    union isfuzzy=true W3CIISLog,\n    (datatable(TimeGenerated:datetime, sComputerName:string, cIP:string, csMethod:string, csUriStem:string, csUserName:string, scStatus:int, csUserAgent:string)[]);\nlet suspiciousFileWrites =\n    fileEventsSource\n    | where TimeGenerated >= ago(lookback)\n    | where ActionType in~ (\"FileCreated\", \"FileModified\", \"FileRenamed\")\n    | where FolderPath has_any (webRoots)\n    | extend FileExtension = tolower(tostring(split(FileName, \".\")[-1])),\n             FileNameLower = tolower(FileName),\n             InitiatingProcessFileName = tostring(InitiatingProcessFileName)\n    | where FileExtension in (suspiciousExtensions) or FileNameLower has_any (suspiciousNames)\n    | where InitiatingProcessFileName !in~ (approvedDeploymentTools)\n    | project WriteTime = TimeGenerated, DeviceId, DeviceName, FolderPath, FileName, FileExtension, SHA256,\n              InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName;\nlet inboundWrites =\n    iisLogsSource\n    | where TimeGenerated >= ago(lookback)\n    | where csMethod in~ (\"POST\", \"PUT\", \"PATCH\")\n    | where csUriStem has_any (\"/upload\", \"/admin\", \"/editor\", \"/api\", \"/wp-admin\", \"/owa\", \"/ecp\")\n    | project RequestTime = TimeGenerated, DeviceName = sComputerName, SrcIP = cIP, csMethod, csUriStem, csUserName, scStatus, csUserAgent;\nsuspiciousFileWrites\n| join kind=leftouter inboundWrites on DeviceName\n| where isnull(RequestTime) or abs(datetime_diff(\"minute\", WriteTime, RequestTime)) <= toint(correlationWindow / 1m)\n| extend CorrelatedInboundRequest = isnotempty(RequestTime)\n| project\n    TimeGenerated = coalesce(RequestTime, WriteTime),\n    WriteTime,\n    RequestTime,\n    DeviceId,\n    DeviceName,\n    FolderPath,\n    FileName,\n    FileExtension,\n    SHA256,\n    InitiatingProcessFileName,\n    InitiatingProcessCommandLine,\n    InitiatingProcessAccountName,\n    CorrelatedInboundRequest,\n    SrcIP,\n    csMethod,\n    csUriStem,\n    csUserName,\n    scStatus,\n    csUserAgent\n| extend timestamp = TimeGenerated,\n         HostCustomEntity = DeviceName,\n         AccountCustomEntity = InitiatingProcessAccountName,\n         IPCustomEntity = SrcIP\n| order by TimeGenerated desc"
      },
      {
        "name": "68c0b6bb-6bd9-4ef4-9011-08998c8ef90f — Application Gateway WAF - SQLi Detection",
        "description": "Identifies a match for SQL Injection attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement. References: https://owasp.org/Top10/A03_2021-Injection/' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let Threshold = 3;\nAzureDiagnostics\n| where Category == \"ApplicationGatewayFirewallLog\"\n| where action_s == \"Matched\"\n| project transactionId_g, hostname_s, requestUri_s, TimeGenerated, clientIp_s, Message, details_message_s, details_data_s\n| join kind = inner(\nAzureDiagnostics\n| where Category == \"ApplicationGatewayFirewallLog\"\n| where action_s == \"Blocked\"\n| parse Message with MessageText 'Total Inbound Score: ' TotalInboundScore ' - SQLI=' SQLI_Score ',XSS=' XSS_Score ',RFI=' RFI_Score ',LFI=' LFI_Score ',RCE=' RCE_Score ',PHPI=' PHPI_Score ',HTTP=' HTTP_Score ',SESS=' SESS_Score '): ' Blocked_Reason '; individual paranoia level scores:' Paranoia_Score\n| where Blocked_Reason contains \"SQL Injection Attack\" and toint(SQLI_Score) >=10 and toint(TotalInboundScore) >= 15) on transactionId_g\n| extend Uri = strcat(hostname_s,requestUri_s)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g), Message = make_set(Message), Detail_Message = make_set(details_message_s), Detail_Data = make_set(details_data_s), Total_TransactionId = dcount(transactionId_g) by clientIp_s, Uri, action_s, SQLI_Score, TotalInboundScore\n| where Total_TransactionId >= Threshold"
      },
      {
        "name": "d0c82b7f-40b2-4180-a4d6-7aa0541b7599 — PulseConnectSecure - CVE-2021-22893 Possible Pulse Connect Secure RCE Vulnerability Attack",
        "description": "This query identifies exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893) to the VPN server' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let threshold = 3;\nPulseConnectSecure\n| where Messages contains \"Unauthenticated request url /dana-na/\"\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Source_IP\n| where count_ > threshold"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "e5d219fd-8362-4b67-a0b8-e3dd4331acdd — Potential SQL Injection Against Microsoft SQL Server",
        "description": "(ESQL) Identifies potential SQL injection attempts against Microsoft SQL Server by detecting obfuscated T-SQL patterns in SQL Server Audit events. Attackers use CHAR concatenation, CONVERT-based subqueries, and CASE/UNION constructs to bypass input validation and extract data or execute unauthorized statements. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from logs-system.application-*, logs-windows.forwarded*, winlogbeat-* metadata _id, _version, _index\n| where host.os.type == \"windows\" and winlog.provider_name like \"MSSQL*\" and event.code == \"33205\"\n| EVAL message_upper = TO_UPPER(message)\n| where (\n    message_upper RLIKE \".*CONVERT\\\\(INT,\\\\(SELECT (CHAR\\\\(\\\\d{1,3}\\\\)\\\\+){3,}.*\" or \n    message_upper RLIKE \".*(CHAR\\\\(\\\\d{1,3}\\\\)\\\\+){3,}CHAR\\\\(\\\\d{1,3}\\\\).*\" or \n    message_upper RLIKE \".*CASE WHEN \\\\(\\\\d+=\\\\d+\\\\).*UNION SELECT \\\\d+.*\" or\n    message_upper RLIKE \".*WAITFOR DELAY \\\\'0:0:\\\\d+\\\\'.*\" or\n    message_upper RLIKE \".*;\\\\s*(EXEC|EXECUTE)\\\\s*\\\\(?\\\\s*(MASTER\\\\.)?\\\\.?XP_CMDSHELL.*\" or\n    message_upper RLIKE \".*UNION SELECT (NULL\\\\s*,\\\\s*){2,}NULL.*\" or\n    message_upper RLIKE \".*'\\\\w*'\\\\s*\\\\+\\\\s*\\\\(\\\\(SELECT @@VERSION\\\\)\\\\)\\\\s*\\\\+\\\\s*'\\\\w*'.*\" or\n    message_upper RLIKE \".*(OR|AND)\\\\s+'?\\\\d+'?\\\\s*=\\\\s*'?\\\\d+'?\\\\s*--.*\"\n  )\n| eval Esql.original_message = message\n| keep\n    @timestamp,\n    host.id,\n    host.name,\n    host.ip,\n    winlog.computer_name,\n    message,\n    event.outcome,\n    Esql.original_message,\n    _id,\n    _version,\n    _index,\n    data_stream.namespace\n\n\n    \n| limit 10"
      },
      {
        "name": "618a219d-a363-4ab1-ba30-870d7c22facd — FortiGate FortiCloud SSO Login from Unusual Source",
        "description": "(ESQL) This rule detects the first successful FortiCloud SSO login from a previously unseen source IP address to a FortiGate device within the last 5 days. FortiCloud SSO logins from new source IPs may indicate exploitation of SAML-based authentication bypass vulnerabilities such as CVE-2026-24858, where crafted SAML assertions allow unauthorized access to FortiGate devices registered to other accounts... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "FROM logs-fortinet_fortigate.* metadata _id, _version, _index\n\n| WHERE data_stream.dataset == \"fortinet_fortigate.log\" and\n        event.category == \"authentication\" and event.action == \"login\" and\n        event.outcome == \"success\" and\n        (fortinet.firewall.method == \"sso\" or fortinet.firewall.ui like \"sso*\") and\n        source.ip is not null\n| STATS Esql.logon_count = COUNT(*),\n        Esql.first_time_seen = MIN(@timestamp),\n        Esql.user_values = VALUES(source.user.name),\n        Esql.observer_name_values = VALUES(observer.name),\n        Esql.message_values = VALUES(message) BY source.ip\n\n// first time seen is within 6m of the rule execution time and for the last 5d of events history\n| EVAL Esql.recent = DATE_DIFF(\"minute\", Esql.first_time_seen, now())\n| WHERE Esql.recent <= 6 AND Esql.logon_count == 1\n\n// move dynamic fields to ECS equivalent for rule exceptions\n| EVAL source.user.name = MV_FIRST(Esql.user_values)\n\n| KEEP source.ip, source.user.name, Esql.*"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Exploit Public-Facing Application activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Authorised penetration test — Suppress WAF detection blocks during confirmed pentest window",
    "Legitimate automation using curl/wget — Exclude specific signed management processes"
  ],
  "confluence": {
    "title": "T1190 - Exploit Public-Facing Application Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}