T1190

← All KQL categories

MITRE ATT&CK Technique

T1190

4 queries tagged with this technique.
View on MITRE ATT&CK →

• Analytics Rules Detect Nextjs Middleware Authorization Bypass

  Next.js middleware authorization-bypass pattern — successful requests to authenticated routes without going through the expected auth path.

• Analytics Rules Detect Peoplesoft Process Spawning Unexpected Shell

  Oracle PeopleSoft server processes (psadmin, psappsrv, java) spawning cmd, bash, whoami, curl, or net — post-exploitation shape of a PeopleSoft RCE.

• Analytics Rules Detect Sharepoint Toolshell Rce Encoded Command

  SharePoint ToolShell RCE: encoded PowerShell arriving via SharePoint worker processes. Multi-token needles (`certutil -decode`) need `contains`, not `has_any`.

• Posture Inventory Exposed Spring Boot Actuator Endpoints

  Inventory of Spring Boot Actuator endpoints that answer 200 anywhere in your estate — flips the entity from "who scanned us" (infinite) to "which of my services answer" (finite and fixable). Recovers the real management base path from traffic.