Detection of Exploitation of Remote Services

ID: DET0767
Domains: ICS
Analytics: AN1899
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1899

Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash, which may be recorded in the application log.
Use deep packet inspection to look for artifacts of common exploit traffic, such as known payloads.

Log Sources
Data Component Name Channel
Application Log Content (DC0038) Application Log None
Network Traffic Content (DC0085) Network Traffic None