← Library
kqlElastic-2.0from elastic/detection-rules

Inbound Connection to an Unsecure Elasticsearch Node

Quality
92
FP risk
—
Forks
0
Views
0
ATT&CK techniques
T1190T1595
Rule sourcerules/network/initial_access_unsecure_elasticsearch_node.toml
(data_stream.dataset: network_traffic.http OR (event.category: network_traffic AND network.protocol: http)) AND
    status:OK AND destination.port:9200 AND network.direction:inbound AND NOT http.response.headers.content-type:"image/x-icon" AND NOT
    _exists_:http.request.headers.authorization