DET0663 Detection of Exploitation of Remote Services

Technique Detected: T1428 (Exploitation of Remote Services)

Analytics

Android

AN1755

Network traffic analysis could reveal patterns of compromise if devices attempt to access unusual targets or resources. Application vetting may be able to identify applications that perform Discovery or utilize existing connectivity to remotely access hosts within an internal enterprise network.

Log Sources

Mutable Elements

iOS

AN1756

Network traffic analysis could reveal patterns of compromise if devices attempt to access unusual targets or resources. Application vetting may be able to identify applications that perform Discovery or utilize existing connectivity to remotely access hosts within an internal enterprise network.

Log Sources

Mutable Elements