Contribute a skill

Network Exposed Service Exploitation

description

Triage a network alert where one source hits one exposed service with repeated logins or exploit payloads — internet-reachable remote admin (SSH, RDP, SMB), brute force against exposed logins, and CVE or exploit attempts on edge appliances. Reads flow records and firewall logs for the source identity, the attempt pattern, and whether any auth succeeded to tell a sanctioned admin apart from access that actually got through, and decides escalate or dismiss.

Triage Steps

This class fires on targeted access to an exposed service — one source pounding one login or one vulnerable edge appliance with repeated auth attempts or exploit payloads. That shape is far more pointed than a scan, but it also overlaps with normal life: admins log in over SSH and RDP all day, jump-hosts and VPN concentrators carry real traffic, and the internet sprays brute force at every public login that exists. So the attempt itself is not the signal. The signal is who the source is and whether anything got through — exploitation of an edge appliance is how intrusions start, so triage here is deciding whether this is expected admin access or someone forcing their way in. The core question is whether the source is a sanctioned admin, jump-host, or VPN range doing expected access, or an external login or exploit that actually landed.

Begin with this detection's track record on this source and target — a rule that fires constantly on background internet brute force against an MFA-protected login and is always closed benign starts the call near dismiss — then read the flow and firewall data for the leads below. None is required on its own; they stack, and a single strong one (a successful auth following the failed attempts from the same source) can carry the call.

Leads that point to a real threat — what to look for in the data:

  • Success after the attempts. Many failed auth flows to a login service, then a session from the same source IP that opened and carried bytes. A run of failures then one real session on :22, :3389, or :445 from a source with no admin standing is the brute force connecting — the failures alone are noise, the success is the breach, and a malicious or suspicious reputation verdict on the source IP makes it decisive. A handful of failures then a login from a corroborated admin, jump-host, or VPN source on its baseline is fat-fingered typo recovery, not a breach; the breach shape is a machine-speed failure run from a source with no such standing.
  • The attempts are connecting. The login flows completed bidirectionally — the source is reaching the auth service and getting answers back on every try.
  • CVE or exploit attempt on an edge asset. A pre-auth exploit payload aimed at an internet-facing appliance — VPN gateway, firewall management, load balancer — on the ports those appliances expose. Edge-appliance exploitation is high-impact and pre-auth, and the resource posture tells you how exposed the target is (Wiz critical-vuln, public-exposure) — a flagged target needs the deeper look even on a single attempt.
  • Internal source against an internal service, or net-new exposure. An internal host hammering another internal host's SSH/RDP/SMB is lateral movement, not perimeter noise. An asset newly reachable from the internet that was not exposed before adds weight — the attack surface just changed.

Leads that rule it out — benign context you can actually see in the data; if the data doesn't show it, you don't have it:

  • A confirmed admin or VPN source. The source IP is the documented bastion, jump-host, or VPN concentrator range, and the access fits that asset's role — expected operations, not an intruder.
  • It matches the target's baseline. This source has logged into this service on this cadence before as normal admin activity, with nothing new in the pattern this time.
  • A documented exposure exception. The internet-facing target is a load balancer or bastion known and intended to be reachable, not surprise exposure.
  • Clean history. This rule has closed benign on this source or target before, with no successful auth and nothing new in the source this time.

To confirm a lead instead of guessing, pull the thread: in the same window after the attempts, did a session from that source open and carry bytes — or did a child action (a new internal connection, a config change) follow on the target? A session that opens after the failures from a source with no admin standing, or a child action on the target, is access confirmed.

Output

Decision

  • escalate: a successful auth following the attempts from a source with no admin standing, brute force that is reaching the service and getting answers, a CVE pre-auth attempt on a critical or edge asset, or an internal source exploiting an internal service — especially two together, or any one with a real session opening after it.
  • dismiss: a confirmed admin, jump-host, or VPN source fitting the asset role — corroborated by its documented range and a login that fits the account's baseline — or a documented exposure exception, explains it; a handful of failures then a success from such a source is routine typo recovery, not a breach. A dismiss is a positive call that the access is benign, made with that context in hand — a documented admin or VPN range you matched, a login cadence the baseline actually shows; a source you couldn't identify or a baseline you couldn't establish is not that context, and absence of a bad sign is not proof it's good. Dismiss is logged and reopenable; when the benign context is missing or you're unsure — or a success follows a machine-speed brute-force run from a source with no such standing, or a CVE payload lands — escalate.

Evidence

The source identity, whether it is a documented admin or VPN range, and its reputation; the target's criticality and CVE exposure from the resource posture; whether any auth succeeded afterward; and how this rule was handled on this source or target before.

Reasoning

Name the leads that decided it and how they stacked — failed logins followed by one real session from the same source, or a CVE payload on an edge appliance, is escalate; a documented VPN range logging in on its normal cadence is dismiss.