Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
CVEs
71
71
64
58
49
This rule detects Windows Admin Center (WAC) creating a listening connection on its default port (6516) on internet-facing devices, specifically when the WAC version is not '2.6.4'. This could indicate an unpatched or vulnerable version of WAC exposed to the internet, potentially making it susceptible to exploitation.
