DET0796 Detection of Internet Accessible Device

Technique Detected: T0883 (Internet Accessible Device)

Analytics

ICS

AN1928

Monitor logon activity for unexpected or unusual access to devices from the Internet. Monitor for unexpected protocols to/from the Internet. While network traffic content and logon session metadata may directly identify a login event, new Internet-based network flows may also be a reliable indicator of this technique. Monitor for unusual logins to Internet connected devices or unexpected protocols to/from the Internet. Network traffic content will provide valuable context and details about the content of network flows.

Log Sources

Mutable Elements