ATT&CK T1072 - Possible Ansible/Remote Deploy Port Access

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects network connections to port 9090 on the home network. The rule is specifically tagged with MITRE ATT&CK technique T1072 (System Configuration Discovery) and mentions 'Ansible/Remote Deploy', suggesting it aims to identify potential remote management or deployment activities that might use this port. It triggers on TCP SYN packets (flags:S) and uses a threshold of 5 connections from the same source within 60 seconds to reduce noise.