ShinyHuntersG1057 ↗
Has exploited CVE-2026-35273 against Oracle PeopleSoft application infrastructure.1 ShinyHunters has exploited known vulnerabilities in internet-facing servers.2
tfMITRE ATT&CK technique
Exploit Public-Facing Application T1190
- Tactic
- Initial Access
- Platforms
- Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows
- Version
- 2.8
- Created
- 18 April 2018
- Last modified
- 12 May 2026
- Contributors
- Praetorian; Yossi Weizman, Azure Defender Research Team; Don Le, Stifel Financial
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
46
Threat groupsTop 2%
Threat groups98th percentile · 98% of ATT&CK techniques have this many threat groups attributed or fewer.21
CampaignsTop 1%
Campaigns100th percentile · 100% of ATT&CK techniques have this many campaigns recorded or fewer.8
Tools & malware72nd pct
Tools & malware72nd percentile · 72% of ATT&CK techniques have this many tools implementing them or fewer.262
Detection rulesTop 1%
Detection rules100th percentile · 100% of ATT&CK techniques have this many detection rules written or fewer.Exploit Public-Facing Application MITRE reference T1190
Top 2%of all ATT&CK techniques for number of groups
46 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
TeamPCPG1056 ↗
Has exploited misconfigurations in GitHub Actions and vulnerabilities such as CVE-2026-33634 in the Aqua Security Trivy scanner and CVE-2025-55182 (React2Shell) against vulnerable cloud endpoints.1234
VOID MANTICOREG1055 ↗
Has exploited public facing vulnerabilities within victim environments to include SharePoint CVE-2019-0604.1
MirrorFaceG1054 ↗
Has exploited vulnerabilities in Fortigate and Array AG devices for initial access.1
Storm-0501G1053 ↗
Has exploited N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler “Citrix Bleed” (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).1
Medusa GroupG1051 ↗
Has leveraged public facing vulnerabilities in their campaigns against victim organizations to gain initial access.12 Medusa Group has also utilized CVE-2024-1709 in ScreenConnect, and CVE-2023-48788 in Fortinet EMS for initial access to victim environments.3
All 46 groups for this technique · 6 newest in this preview
21 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Anthropic AI-orchestrated CampaignC0062 ↗
During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to deploy a custom exploit payload targeting an identified SSRF vulnerability to gain initial access to a targeted environment.1
SharePoint ToolShell ExploitationC0058 ↗
During SharePoint ToolShell Exploitation, threat actors exploited authentication bypass and remote code execution vulnerabilities (CVE-2025-49706 and CVE-2025-49704) against on-premises SharePoint servers. This activity was characterized by crafted POST requests to the ToolPane endpoint /_layouts/15/ToolPane.aspx.123456
Operation Digital EyeC0061 ↗
During Operation Digital Eye, threat actors used SQL injection to compromise publicly exposed web and database servers.1
Versa Director Zero Day ExploitationC0039 ↗
Involved exploitation of a vulnerability in Versa Director servers, since identified as CVE-2024-39717, for initial access and code execution.1
Operation MidnightEclipseC0048 ↗
During Operation MidnightEclipse, threat actors exploited CVE-2024-3400 in Palo Alto Networks GlobalProtect.12
FrostyGoop IncidentC0041 ↗
Was likely enabled by the adversary exploiting an unknown vulnerability in an external-facing router.1
All 21 campaigns for this technique · 6 newest in this preview
8 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
QilinS1242 ↗
Has been delivered through exploitation of exposed applications and interfaces including Citrix and RDP.1
BOLDMOVES1184 ↗
Is associated with exploitation of CVE-2022-49475 in FortiOS.1
COATHANGERS1105 ↗
Is installed following exploitation of a vulnerable FortiGate device. 1
SiloscapeS0623 ↗
Is executed after the attacker gains initial access to a Windows container using a known vulnerability.1
SoreFangS0516 ↗
Can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.1
ZxShellS0412 ↗
Has been dropped through exploitation of CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.1
All 8 software entries for this technique · 6 newest in this preview
Offense vs defense T1190
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 20Sigma rules (cumulative) · 151Splunk ESCU (cumulative) · 111
first rule: 2017 Q1 · 20 of 21 campaigns plotted (Night Dragon (dated 2009) falls before the 2014 window)Exploit Public-Facing Application detection strategy DET0080
MITRE names one behaviour worth catching for this technique and breaks it into 7 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
7 platforms
AN0219 · Windows
Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Application Log ContentDC0038 | ApplicationLog:IIS | IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PublicVIPs | List of public IPs/hostnames that front apps; used to scope web log and Zeek/proxy data. |
| SuspiciousPatterns | Regex set for exploit-like inputs (../, union select, cmd=, ${jndi:, rO0AB (Java serialization), %00, ${env:}, ${${::-j}ndi}). |
| ErrorRateThreshold | Spike threshold for HTTP status 5xx/4xx per client or URI (e.g., >5 in 5m). |
| TimeWindow | Correlation horizon between request, error, process spawn, and egress (e.g., 15 minutes). |
| AllowedChildList | Known child processes of app pools (e.g., msbuild.exe in CI) to reduce false positives. |
AN0220 · Linux
Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| Application Log ContentDC0038 | ApplicationLog:WebServer | /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors |
| Network Traffic ContentDC0085 | NSM:Flow | HTTP payloads with SQLi/LFI/JNDI/deserialization indicators |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WebProcList | server/interpreter names to watch (apache2, httpd, nginx, php-fpm, uwsgi, gunicorn, node). |
| ChildToolList | post-exploitation binaries (sh, bash, curl, wget, python, perl, socat, nc). |
| BurstThreshold | Rate of errors/requests per src_ip/uri to flag reconnaissance/exploit spray. |
| TimeWindow | Exec/network correlation window. |
AN0221 · macOS
Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | exec events where web process starts a shell/tooling |
| Application Log ContentDC0038 | macos:unifiedlog | App/web server logs ingested via unified logging or filebeat (nginx/apache/node). |
| Network Traffic ContentDC0085 | NSM:Flow | outbound egress from web host after suspicious request |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ServiceList | Names/paths of public daemons on macOS (httpd, nginx, node, java). |
| TimeWindow | Correlation window for request → exec → egress. |
AN0222 · Containers
Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | docker:events | Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container |
| Application Log ContentDC0038 | ApplicationLog:Ingress | Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes |
| Network Traffic ContentDC0085 | NSM:Flow | Requests towards cloud metadata or command & control from pod IPs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| IngressNamespaces | Namespaces that are Internet-facing. |
| MetadataEndpoints | Cloud metadata IPs/hostnames for exfil of credentials. |
| TimeWindow | Join period between ingress request and pod exec/egress. |
AN0223 · IaaS
Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic FlowDC0078 | AWS:VPCFlowLogs | VPC/NSG flow logs for pod/instance egress to Internet or metadata |
| Network Traffic ContentDC0085 | ALB:HTTPLogs | AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| LBProjects | Cloud accounts/subscriptions/regions to include. |
| ErrorBurst | 5xx/4xx per client threshold. |
AN0224 · ESXi
Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | esxi:hostd | /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections |
| Network Traffic ContentDC0085 | NSM:Flow | Connections to TCP 427 (SLP) or vCenter web services from untrusted sources |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MgmtCIDR | Only trusted admin networks should reach ESXi/vCenter. |
| TimeWindow | Join errors and inbound flows. |
AN0225 · Network Devices
Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | networkdevice:controlplane | Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands |
| Network Traffic ContentDC0085 | NSM:Flow | NetFlow/sFlow for odd egress to Internet from mgmt plane |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MgmtPorts | List of admin services to watch (8443, 443, 161/udp, 4786, 22). |
| TrustedAdmins | Admin source ranges to allow. |
Application isolation will limit what other processes and system features the exploited target can access.
Exploit ProtectionM1050
Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.
Restrict outbound network traffic from public-facing servers to prevent unauthorized connections from initiating communications with attacker-controlled infrastructure. While this may not prevent the initial exploitation, it limits the attacker's ability to verify and control the compromised server post-exploit, reducing the overall impact of the attack.
Ensure that all publicly exposed services are actually intended to be so, and restrict access to any that should only be available internally.
Network SegmentationM1030
Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.
Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.
Update SoftwareM1051
Update software regularly by employing patch management for externally exposed applications.
Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.