Internet-Facing Windows Admin Center Listening on Default Port (Non-2.6.4 Version)
This rule detects Windows Admin Center (WAC) creating a listening connection on its default port (6516) on internet-facing devices, specifically when the WAC version is not '2.6.4'. This could indicate an unpatched or vulnerable version of WAC exposed to the internet, potentially making it susceptible to exploitation.
Microsoft Sentinel (KQL)
