Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1210

Exploitation of Remote Services

Lateral Movement 114 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Unusual Child Process of dns.exe production 2026-10-09
elastic Potential WSUS Abuse for Lateral Movement production 2026-09-18
elastic Azure AKS Kubelet Proxy to Command Execution Endpoint production 2026-09-18
elastic Azure AKS API Server Proxying Request to Kubelet production 2026-09-18
elastic Unusual File Operation by dns.exe production 2026-09-18
elastic Microsoft Exchange Server UM Spawning Suspicious Processes production 2026-09-18
elastic High Mean of Process Arguments in an RDP Session production 2026-09-18
elastic Microsoft Exchange Server UM Writing Suspicious Files production 2026-09-18
elastic Abnormally Large DNS Response production 2026-09-18
elastic Potential Polyglot Bypass File Created by Web Server production 2026-09-18
elastic Unusual Remote File Size production 2026-09-18
elastic Telnet Authentication Bypass via User Environment Variable production 2026-09-18
elastic High Mean of RDP Session Duration production 2026-09-18
elastic Unusual Time or Day for an RDP Session production 2026-09-18
elastic Spike in Remote File Transfers production 2026-09-18
elastic Spike in Number of Processes in an RDP Session production 2026-09-18
elastic Spike in Number of Connections Made to a Destination IP production 2026-09-18
elastic Spike in Number of Connections Made from a Source IP production 2026-09-18
elastic Unusual Remote File Extension production 2026-09-18
elastic Unusual Remote File Directory production 2026-09-18
elastic High Variance in RDP Session Duration production 2026-09-18
elastic File with High Entropy Created by Web Server production 2026-09-18
elastic File with Suspicious Double Extension Created by Web Server production 2026-09-18
elastic Potential Telnet Authentication Bypass (CVE-2026-24061) production 2026-09-18
splunk Linux Suspicious Redis Activity production 2026-07-08
splunk Splunk RCE Through Arbitrary File Write to Windows System Root production 2026-06-23
splunk Splunk RCE via User XSLT production 2026-05-14
splunk Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity production 2026-05-13
splunk VMWare Aria Operations Exploit Attempt production 2026-05-13
splunk Active Directory Lateral Movement Identified production 2026-05-13
splunk Detect Computer Changed with Anonymous Account production 2026-05-13
splunk Cisco Secure Firewall - Lumma Stealer Activity production 2026-05-13
splunk Cisco Secure Firewall - Static Tundra Smart Install Abuse production 2026-05-13
sigma OMIGOD HTTP No Authentication RCE - CVE-2021-38647 stable 2025-11-03
sigma WannaCry Ransomware Activity test 2025-10-18
suricata ET EXPLOIT GTPDoor Trigger Packet Request rev 1 2025-07-09
suricata ET INFO Invalid GTP Response Packet Observed rev 1 2025-07-09
suricata ET EXPLOIT GTPDoor Trigger Packet Response rev 1 2025-07-09
suricata ET MALWARE PolarEdge Webshell Activity rev 1 2025-02-28
snort ET TROJAN PolarEdge Webshell Activity rev 1 2025-02-28
sigma DNS Query Request By QuickAssist.EXE experimental 2024-12-19
sigma HackTool - SharpWSUS/WSUSpendu Execution test 2024-08-23
suricata ET WEB_SPECIFIC_APPS Ruijie Network Switches Unauthenticated Command Execution rev 2 2024-04-29
suricata ET SCAN COMMIX Command injection scan attempt rev 6 2024-04-28
suricata ET EXPLOIT Hootoo TripMate Attempted Remote Command Injection Inbound rev 4 2024-04-13
suricata ET EXPLOIT Hootoo TripMate Attempted Remote Command Injection Outbound rev 4 2024-04-13
suricata ET EXPLOIT Possible WePresent WIPG1000 OS Command Injection rev 5 2024-04-13
suricata ET EXPLOIT Dell KACE Attempted Remote Command Injection Outbound rev 5 2024-04-13
suricata ET EXPLOIT Dell KACE Attempted Remote Command Injection Inbound rev 5 2024-04-13
suricata ET EXPLOIT AVTECH Authenticated Command Injection in CloudSetup.cgi rev 4 2024-04-13
suricata ET EXPLOIT AVTECH Authenticated Command Injection in PwdGrp.cgi rev 4 2024-04-13
suricata ET EXPLOIT Eir D1000 Remote Command Injection Attempt Outbound rev 3 2024-04-13
suricata ET EXPLOIT Eir D1000 Remote Command Injection Attempt Inbound rev 3 2024-04-13
suricata ET EXPLOIT Netgear R7000 Command Injection Exploit rev 4 2024-04-12
elastic Deprecated - Remote File Creation on a Sensitive Directory deprecated 2024-04-01
snort ET WEB_SPECIFIC_APPS Ruijie Network Switches Unauthenticated Command Execution rev 1 2024-03-15
suricata ET EXPLOIT Possible 2012-1533 altjvm RCE via JNLP command injection rev 4 2024-03-13
suricata ET EXPLOIT NetGain Enterprise Manager 7.2.562 Ping Command Injection rev 4 2024-03-07
suricata ET EXPLOIT AVTECH Authenticated Command Injection in adcommand.cgi rev 3 2024-03-07
suricata ET EXPLOIT AVTECH Unauthenticated Command Injection in DVR Devices rev 3 2024-03-07
suricata ET EXPLOIT BlueCoat CAS v1.3.7.1 Report Email Command Injection attempt rev 4 2024-03-07
suricata ET WEB_SPECIFIC_APPS Mailtrail v0.53 Command Injection Attempt rev 2 2024-01-26
snort ET WEB_SPECIFIC_APPS Mailtrail v0.53 Command Injection Attempt rev 2 2024-01-26
elastic Malicious Remote File Creation deprecated 2023-12-14
sigma Exploitation Attempt Of CVE-2023-46214 Using Public POC Code test 2023-11-27
sigma Potential CVE-2023-46214 Exploitation Attempt test 2023-11-27
sigma Terminal Service Process Spawn test 2023-01-25
sigma Scanner PoC for CVE-2019-0708 RDP RCE Vuln test 2022-12-25
sigma Potential RDP Exploit CVE-2019-0708 test 2022-12-25
sigma Audit CVE Event test 2022-10-22
sigma Suspicious SysAidServer Child test 2022-08-26
sigma Possible Exploitation of Exchange RCE CVE-2021-42321 test 2022-07-12
snort ET WEB_SERVER LANDesk Command Injection Attempt rev 8 2022-05-03
sigma Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC test 2022-02-12
suricata ET EXPLOIT Qianxin Netcom NGFW Command Injection rev 1 2022-01-11
snort ET EXPLOIT Qianxin Netcom NGFW Command Injection rev 1 2022-01-11
sigma Apache Threading Error test 2021-11-27
sigma Zerologon Exploitation Using Well-known Tools stable 2021-05-30
snort ET EXPLOIT Possible WePresent WIPG1000 OS Command Injection rev 3 2020-11-11
suricata ET WEB_SERVER LANDesk Command Injection Attempt rev 9 2020-11-07
suricata ET EXPLOIT Geutebruck Attempted Remote Command Injection Outbound rev 4 2020-09-17
suricata ET EXPLOIT Geutebruck Attempted Remote Command Injection Inbound rev 4 2020-09-17
suricata ET EXPLOIT Possible OpenDreamBox Attempted Remote Command Injection Outbound rev 3 2020-08-31
suricata ET EXPLOIT Possible OpenDreamBox Attempted Remote Command Injection Inbound rev 3 2020-08-31
suricata ET EXPLOIT VMware NSX SD-WAN Command Injection 2 rev 3 2020-08-25
suricata ET EXPLOIT VMware NSX SD-WAN Command Injection rev 3 2020-08-25
suricata ET EXPLOIT D-Link DSL-2750B - OS Command Injection rev 3 2020-08-25
suricata ET EXPLOIT UCM6202 1.0.18.13 - Remote Command Injection Attempt rev 2 2020-08-19
snort ET EXPLOIT UCM6202 1.0.18.13 - Remote Command Injection Attempt rev 2 2020-05-22
suricata ET EXPLOIT DynoRoot DHCP - Client Command Injection rev 2 2019-07-26
snort ET EXPLOIT Geutebruck Attempted Remote Command Injection Outbound rev 3 2019-06-18
snort ET EXPLOIT Geutebruck Attempted Remote Command Injection Inbound rev 3 2019-06-18
snort ET EXPLOIT Possible OpenDreamBox Attempted Remote Command Injection Outbound rev 3 2019-06-18
snort ET EXPLOIT Possible OpenDreamBox Attempted Remote Command Injection Inbound rev 3 2019-06-18
snort ET EXPLOIT Dell KACE Attempted Remote Command Injection Inbound rev 3 2019-06-18
snort ET EXPLOIT Dell KACE Attempted Remote Command Injection Outbound rev 3 2019-06-18
snort ET EXPLOIT Hootoo TripMate Attempted Remote Command Injection Outbound rev 3 2019-06-18
snort ET EXPLOIT Hootoo TripMate Attempted Remote Command Injection Inbound rev 3 2019-06-18
snort ET EXPLOIT Eir D1000 Remote Command Injection Attempt Inbound rev 2 2019-05-23
snort ET EXPLOIT Eir D1000 Remote Command Injection Attempt Outbound rev 2 2019-05-23
snort ET EXPLOIT NetGain Enterprise Manager 7.2.562 Ping Command Injection rev 2 2018-09-10
snort ET EXPLOIT VMware NSX SD-WAN Command Injection 2 rev 2 2018-07-02
snort ET EXPLOIT VMware NSX SD-WAN Command Injection rev 2 2018-07-02
snort ET EXPLOIT DynoRoot DHCP - Client Command Injection rev 2 2018-06-29
snort ET EXPLOIT D-Link DSL-2750B - OS Command Injection rev 2 2018-06-27
snort ET EXPLOIT AVTECH Unauthenticated Command Injection in DVR Devices rev 2 2017-10-25
snort ET EXPLOIT AVTECH Authenticated Command Injection in PwdGrp.cgi rev 2 2017-10-25
snort ET EXPLOIT AVTECH Authenticated Command Injection in adcommand.cgi rev 2 2017-10-25
snort ET EXPLOIT AVTECH Authenticated Command Injection in CloudSetup.cgi rev 2 2017-10-25
snort ET EXPLOIT BlueCoat CAS v1.3.7.1 Report Email Command Injection attempt rev 1 2017-04-21
snort ET EXPLOIT Netgear R7000 Command Injection Exploit rev 2 2016-12-12
snort ET SCAN COMMIX Command injection scan attempt rev 1 2015-12-11
snort ET EXPLOIT Possible 2012-1533 altjvm RCE via JNLP command injection rev 1 2013-06-13
sentinel Gain Code Execution on ADFS Server via Remote WMI Execution Scheduled —