Coverage › CVE-2010-2861

CVE-2010-2861 Mapped Sigma

Adobe ColdFusion Directory Traversal Vulnerability

Vendor / product: Adobe — ColdFusion
Description (CISA): A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.
Added to KEV: 2022-03-25
Due date: 2022-04-15
Required action: Apply updates per vendor instructions.
Known ransomware use: Known
CWE: CWE-22
CISA notes: https://nvd.nist.gov/vuln/detail/CVE-2010-2861
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1190 Exploit Public-Facing Application	exploitation technique	This is the exploitation of a public facing server. In-the-wild reporting documents that exploitation of this vulnerability was used to install a webshell on the victim machine, and then captured and exfiltrated client credit card information. ref 1	live
T1105 Ingress Tool Transfer	primary impact	This is the exploitation of a public facing server. In-the-wild reporting documents that exploitation of this vulnerability was used to install a webshell on the victim machine, and then captured and exfiltrated client credit card information. ref 1	live
T1119 Automated Collection	secondary impact	This is the exploitation of a public facing server. In-the-wild reporting documents that exploitation of this vulnerability was used to install a webshell on the victim machine, and then captured and exfiltrated client credit card information. ref 1	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1105 Ingress Tool Transfer primary impact

DET0060 Detect Ingress Tool Transfers via Behavioral Chain
AN0165 Windows
Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).

WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: ParentProcessName DestinationIPCategory FilePathRegex

AN0166 Linux
Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.

auditd:SYSCALL connect, execve, write → DC0064 Command Execution
auditd:SYSCALL file creation/modification → DC0039 File Creation
iptables:LOG TCP connections → DC0078 Network Traffic Flow

Tunable: ToolName DownloadExtension

AN0167 macOS
Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.

macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC → DC0032 Process Creation
macos:unifiedlog file write/create → DC0039 File Creation
macos:unifiedlog connection open → DC0082 Network Connection Creation

Tunable: DirectoryTargeted ProcessPath

AN0168 ESXi
Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.

esxi:hostd command execution → DC0064 Command Execution
esxi:vmkernel file write → DC0039 File Creation

Tunable: ToolName DatastorePath

AN0169 Network Devices
Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.

NSM:Flow connection metadata → DC0078 Network Traffic Flow
snmp:syslog firmware write/log event → DC0039 File Creation

Tunable: PayloadVolumeThreshold ProtocolUsed

Sigma rules tagged `attack.t1105` (87)

Suspicious Curl File Upload - Linux mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) · 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582

Detects a suspicious curl process start the adds a file to a web request

Techniques: T1567 T1105

Potential Data Exfiltration Via Curl.EXE mediumtest

Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update) · 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04

Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration

Techniques: T1567 T1105

Suspicious Download from Office Domain hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-12-27 (modified 2022-08-02) · logsource: product=windows category=process_creation · 00d49ed5-4491-4271-a8db-650a4ef6f8c1

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Techniques: T1105 T1608

Potential COM Objects Download Cradles Usage - Process Creation mediumtest

Author: frack113 · 2022-12-25 · logsource: product=windows category=process_creation · 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Techniques: T1105

Insensitive Subfolder Search Via Findstr.EXE lowtest

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Techniques: T1218 T1564.004 T1552.001 T1105

Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-13 · logsource: product=windows category=image_load · 04fc4b22-91a6-495a-879d-0144fec5ec03

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.

Techniques: T1218 T1105

CVE tags: CVE-2025-33053

Local Network Connection Initiated By Script Interpreter mediumtest

Author: frack113 · 2022-08-28 (modified 2024-05-31) · logsource: product=windows category=network_connection · 08249dc0-a28d-4555-8ba5-9255a198e08c

Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.

Techniques: T1105

Axios NPM Compromise Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

Techniques: T1195.002 T1059.006 T1059.004 T1105

Uncommon Network Connection Initiated By Certutil.EXE hightest

Author: frack113, Florian Roth (Nextron Systems) · 2022-09-02 (modified 2024-05-31) · logsource: product=windows category=network_connection · 0dba975d-a193-4ed1-a067-424df57570d1

Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.

Techniques: T1105

File Download with Headless Browser hightest

Author: Sreeman, Florian Roth (Nextron Systems) · 2022-01-04 (modified 2025-10-07) · logsource: product=windows category=process_creation · 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Techniques: T1105 T1564.003

Potential DLL File Download Via PowerShell Invoke-WebRequest mediumtest

Author: Florian Roth (Nextron Systems), Hieu Tran · 2023-03-13 (modified 2025-07-18) · logsource: product=windows category=process_creation · 0f0450f3-8b47-441e-a31b-15a91dc243e2

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.

Techniques: T1059.001 T1105

Potential In-Memory Download And Compile Of Payloads mediumtest

Author: Sohan G (D4rkCiph3r), Red Canary (idea) · 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Techniques: T1059.007 T1105

Suspicious File Downloaded From Direct IP Via Certutil.EXE hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 13e6fe51-d478-4c7e-b0f2-6da9b400a829

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Techniques: T1027 T1105

Suspicious Diantz Download and Compress Into a CAB File mediumtest

Author: frack113 · 2021-11-26 (modified 2022-08-13) · logsource: product=windows category=process_creation · 185d7418-f250-42d0-b72e-0c8b70661e93

Download and compress a remote file and store it in a cab file on local machine.

Techniques: T1105

Download from Suspicious Dyndns Hosts mediumtest

Author: Florian Roth (Nextron Systems) · 2017-11-08 (modified 2023-05-18) · logsource: category=proxy · 195c1119-ef07-4909-bb12-e66f5e07bf3c

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Techniques: T1105 T1568

All 87 rules on the technique page →

T1119 Automated Collection secondary impact

DET0186 Automated File and API Collection Detection Across Platforms
AN0531 Windows
Automated execution of native utilities and scripts to discover, enumerate, and exfiltrate files and clipboard content. Focus is on detecting repeated file access, scripting engine use, and use of command-line utilities commonly leveraged by collection scripts.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

Tunable: TimeWindow SuspiciousFileExtensions ProcessCountThreshold

AN0532 Linux
Repeated or automated access to user document directories or clipboard using shell scripts or utilities like xclip/pbpaste. Detectable via auditd syscall logs or osquery file events.

auditd:SYSCALL execve → DC0032 Process Creation
auditd:SYSCALL open → DC0055 File Access

Tunable: AccessPath ScriptInterpreterList

AN0533 macOS
Use of pbpaste, AppleScript, or third-party automation frameworks (e.g., Automator) to collect clipboard or file content in bursts. Observable via unified logs.

macos:unifiedlog logMessage contains pbpaste or osascript → DC0032 Process Creation
macos:unifiedlog subsystem=launchservices → DC0029 Script Execution

Tunable: AutomationTool ClipboardCheckRate

AN0534 SaaS
Suspicious sign-ins to Graph API or sensitive resources using non-browser scripting agents (e.g., Python, PowerShell), often for programmatic access to mailbox or OneDrive content.

azure:signinlogs Operation=UserLogin → DC0002 User Account Authentication

Tunable: UserAgentFilter ExpectedClientIPList DeviceProperties

Sigma rules tagged `attack.t1119` (5)

Shai-Hulud Malicious GitHub Workflow Creation highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-09-24 (modified 2026-01-24) · logsource: product=linux category=file_event · 0aba5685-6db6-486f-88ef-29a99c545cfd

Detects creation of shai-hulud-workflow.yml file associated with Shai Hulud worm targeting NPM supply chain attack that exfiltrates GitHub secrets

Techniques: T1552.001 T1119

Recon Information for Export with PowerShell mediumtest

Author: frack113 · 2021-07-30 (modified 2022-12-25) · logsource: product=windows category=ps_script · a9723fcc-881c-424c-8709-fd61442ab3c3

Once established within a system or network, an adversary may use automated techniques for collecting internal data

Techniques: T1119

Recon Information for Export with Command Prompt mediumtest

Author: frack113 · 2021-07-30 (modified 2022-09-13) · logsource: product=windows category=process_creation · aa2efee7-34dd-446e-8a37-40790a66efd7

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Techniques: T1119

Automated Collection Command PowerShell mediumtest

Author: frack113 · 2021-07-28 (modified 2022-12-25) · logsource: product=windows category=ps_script · c1dda054-d638-4c16-afc8-53e007f3fbc5

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Techniques: T1119

Automated Collection Command Prompt mediumtest

Author: frack113 · 2021-07-28 (modified 2022-11-11) · logsource: product=windows category=process_creation · f576a613-2392-4067-9d1a-9345fb58d8d1

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Techniques: T1119 T1552.001

T1190 Exploit Public-Facing Application exploitation technique

DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
AN0219 Windows
Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList

AN0220 Linux
Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content
auditd:SYSCALL execve → DC0032 Process Creation
NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

Tunable: WebProcList ChildToolList BurstThreshold TimeWindow

AN0221 macOS
Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content
macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation
NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

Tunable: ServiceList TimeWindow

AN0222 Containers
Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content
docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation
NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

Tunable: IngressNamespaces MetadataEndpoints TimeWindow

AN0223 IaaS
Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content
AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

Tunable: LBProjects ErrorBurst

AN0224 ESXi
Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content
NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

Tunable: MgmtCIDR TimeWindow

AN0225 Network Devices
Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content
NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged `attack.t1190` (149)

Potential CVE-2023-25717 Exploitation Attempt hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-30 · logsource: category=webserver · 043c1609-0e32-4462-a6f2-5a0c2da3fafe

Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

Techniques: T1190

CVE tags: CVE-2023-25717

Potential CVE-2021-27905 Exploitation Attempt mediumtest

Author: @gott_cyber · 2022-12-11 (modified 2023-03-24) · logsource: category=webserver · 0bbcd74b-0596-41a4-94a0-4e88a76ffdb3

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Techniques: T1190

CVE tags: CVE-2021-27905

Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195 criticaltest

Author: Florian Roth (Nextron Systems) · 2020-07-10 (modified 2023-01-02) · logsource: category=webserver · 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Techniques: T1190

CVE tags: CVE-2020-8193CVE-2020-8195

Ruby on Rails Framework Exceptions mediumstable

Author: Thomas Patzke · 2017-08-06 (modified 2020-09-01) · logsource: product=ruby_on_rails category=application · 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Techniques: T1190

Potential CVE-2023-23752 Exploitation Attempt hightest

Author: Bhabesh Raj · 2023-02-23 · logsource: category=webserver · 0e1ebc5a-15d0-4bf6-8199-b2535397433a

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Techniques: T1190

CVE tags: CVE-2023-23752

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Terminal Service Process Spawn hightest

Author: Florian Roth (Nextron Systems) · 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Techniques: T1190 T1210

RDS Database Security Group Modification mediumtest

Author: jamesc-grafana · 2024-07-11 · logsource: product=aws service=cloudtrail · 14f3f1c8-02d5-43a2-a191-91ffb52d3015

Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.

Techniques: T1190

Cisco ASA Exploitation Activity - Proxy highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-20 · logsource: category=proxy · 15697955-6a29-47ca-92e9-0e05efae3260

Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.

Techniques: T1190

CVE tags: CVE-2025-20333CVE-2025-20362

TerraMaster TOS CVE-2020-28188 hightest

Author: Bhabesh Raj · 2021-01-25 (modified 2023-01-02) · logsource: category=webserver · 15c312b9-00d0-4feb-8870-7d940a4bdc5e

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Techniques: T1190

CVE tags: CVE-2020-28188

Potential Server Side Template Injection In Velocity hightest

Author: Moti Harmats · 2023-02-11 · logsource: product=velocity category=application · 16c86189-b556-4ee8-b4c7-7e350a195a4f

Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

Techniques: T1190

CVE-2021-21972 VSphere Exploitation hightest

Author: Bhabesh Raj · 2021-02-24 (modified 2023-01-02) · logsource: category=webserver · 179ed852-0f9b-4009-93a7-68475910fd86

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

Techniques: T1190

CVE tags: CVE-2021-21972

Potential OWASSRF Exploitation Attempt - Webserver hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-22 (modified 2023-01-02) · logsource: category=webserver · 181f49fa-0b21-4665-a98c-a57025ebb8c7

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Techniques: T1190

Suspicious User-Agents Related To Recon Tools mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton · 2022-07-19 (modified 2026-06-11) · logsource: category=webserver · 19aa4f58-94ca-45ff-bc34-92e533c0994a

Detects known suspicious (default) user-agents related to scanning/recon tools

Techniques: T1190

Python SQL Exceptions mediumstable

Author: Thomas Patzke · 2017-08-12 (modified 2020-09-01) · logsource: product=python category=application · 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9

Generic rule for SQL exceptions in Python according to PEP 249

Techniques: T1190

All 149 rules on the technique page →

CVE-2010-2861 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1105 Ingress Tool Transfer primary impact

Sigma rules tagged attack.t1105 (87)

T1119 Automated Collection secondary impact

Sigma rules tagged attack.t1119 (5)

T1190 Exploit Public-Facing Application exploitation technique

Sigma rules tagged attack.t1190 (149)

Sigma rules tagged `attack.t1105` (87)

Sigma rules tagged `attack.t1119` (5)

Sigma rules tagged `attack.t1190` (149)