T1190 Exploit Public-Facing Application

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. MITRE ATT&CK

29 Sigma rules T1190 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first

criticalDNS RCE CVE-2020-1350Florian Roth (Nextron Systems) · Windows

highApache Spark Shell Command Injection - ProcessCreationNasreddine Bencherchali (Nextron Systems) · Linux

highAtlassian Confluence CVE-2022-26134Nasreddine Bencherchali (Nextron Systems) · Linux

highCommvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791)X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

highCVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)Andreas Braathen (mnemonic.io) · Linux

highCVE-2024-50623 Exploitation Attempt - CleoTanner Filip, Austin Worline, Chad Hudson, Matt Anderson · Windows

highExploitation Activity of CVE-2025-59287 - WSUS Suspicious Child ProcessHuntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

highExploited CVE-2020-10189 Zoho ManageEngineFlorian Roth (Nextron Systems) · Windows

highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali · Linux

highOMIGOD SCX RunAsProvider ExecuteScriptRoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · Linux

highOMIGOD SCX RunAsProvider ExecuteShellCommandRoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · Linux

highPotential Atlassian Confluence CVE-2021-26084 Exploitation AttemptBhabesh Raj · Windows

highPotential CVE-2021-44228 Exploitation Attempt - VMware Horizon@kostastsale · Windows

highPotential Exploitation Attempt Of Undocumented WindowsServer RCEFlorian Roth (Nextron Systems), Nasreddine Bencherchali · Windows

highPotential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)Nisarg Suthar · Windows

highPotential Exploitation of GoAnywhere MFT VulnerabilityMSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

highPotential SharePoint ToolShell CVE-2025-53770 Exploitation IndicatorsSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highRemote Access Tool - ScreenConnect Server Web Shell ExecutionJason Rathbun (Blackpoint Cyber) · Windows

highSuspicious Child Process of SolarWinds WebHelpDeskHuntress Team, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

highSuspicious Child Process Of SQL ServerFPT.EagleEye Team, wagga · Windows

highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious Processes Spawned by WinRMAndreas Hunkeler (@Karneades), Markus Neis · Windows

highTerminal Service Process SpawnFlorian Roth (Nextron Systems) · Windows

highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali · Windows

mediumCVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)Andreas Braathen (mnemonic.io) · Windows

mediumPotential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution@kostastsale · Windows

mediumSuspicious Child Process of SAP NetWeaverElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumSuspicious Child Process of SAP NetWeaver - LinuxElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems) · Linux

mediumSuspicious CrushFTP Child ProcessCraig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows