Insecure IoT network services

Exposed telnet/UPnP services provide entry

categoryWireless, mobile, IoT and OT/ICS attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1021 · Android Debug Bridge network connection (TCP 5555, Windows / Sysmon EID3)

powershell -NoProfile -ExecutionPolicy Bypass -File C:\lab\e2-port-probe.ps1 -Ports 5555 -Technique T1021 -RunId <run-id>

ATT&CK T1021

powershell -NoProfile -ExecutionPolicy Bypass -File C:\lab\e2-port-probe.ps1 -Ports 5555 -Technique T1021 -RunId run-2026-09-28-001

ATT&CK T1021 · Android Debug Bridge network connection (TCP 5555)

sudo /opt/lab/e2-port-probe.sh --target 10.10.10.22 --ports 5555 --technique T1021 --run-id <run-id>

+ 2 more test variant(s) in the corpus.

What our lab measured

detected linux · 2026-09-29 · detected in 103s

Detection that fired

✓ Wazuh 100311 (level 7) lab rule — Mobile-adjacent (Linux): Android Debug Bridge (adb) connect() to TCP 5555, from auditd SOCKADDR. Mobile ref T1428.

Plus 3 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~82 incidental alerts/hour — tune against this.

detected windows · 2026-09-28 · detected in 39s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
Sysmon · EID 3	Mobile-adjacent: Android Debug Bridge (adb) network connection on TCP 5555. Mobile ref T1428.

Detection that fired

✓ Wazuh 100301 (level 7) lab rule — Mobile-adjacent: Android Debug Bridge (adb) network connection on TCP 5555. Mobile ref T1428.

Plus 1 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~79 incidental alerts/hour — tune against this.

10 public Sigma rule(s) also target this technique.

Classification

20 values: 16 reviewed, 3 lab-measured, 1 derived. What do these mean?

Exploitability

Attack vector	Wireless, mobile & IoT/OT
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	AvailabilityConfidentialityIntegrity
Environment	Edge / IoT
Target asset class	Network devicePhysicalServer

Detection & telemetry

Detectability (measured in our lab)	Medium
Noise level	High
Testability	Custom lab test

Detection & response

Detected by 2

100301 wazuh
100311 wazuh

Tested by 2

lab-custom-e2-adb-probe other
lab-custom-e2-adb-probe-win other

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-09-26-001`	detected	other	linux	2026-09-26
`run-2026-09-28-001`	detected	other	windows	2026-09-28
`run-2026-09-29-001`	detected	other	linux	2026-09-29

run-2026-09-26-001 — E2 probe for Wazuh rule 100311 (Linux/auditd sibling of 100301; mobile-adjacent; the enterprise T1021 tag is what the manager's bundled MITRE DB can resolve). Same benign connect-only behaviour.; expected=1 incidental=5 max_level=7 dwell_s=90
run-2026-09-28-001 — E2 probe for Wazuh rule 100301 (the Windows/Sysmon sibling of 100311; mobile-adjacent). Same benign, connect-only behaviour as the Linux probe, but completes the connection so Sysmon EID 3 is emitted.; expected=1 incidental=3 max_level=15 dwell_s=90
run-2026-09-29-001 — E2 probe for Wazuh rule 100311 (Linux/auditd sibling of 100301; mobile-adjacent; the enterprise T1021 tag is what the manager's bundled MITRE DB can resolve). Same benign connect-only behaviour.; expected=1 incidental=5 max_level=7 dwell_s=90

Framework references

Primary source: https://owasp.org/www-project-internet-of-things/
owasp-iot: I2 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Wireless, mobile, IoT and OT/ICS attacks' table, line 497 of Cyber-Attack-Taxonomy.md
ev-0002 (Phase 4 detection lab - detonation runs 2026-09-26) — Lab detonation run-2026-09-26-001 (detected): Wazuh rule(s) 100311 fired on T1021 within the detonation window
Mobile-adjacent (Linux): Android Debug Bridge (adb) connect() to TCP 5555, from auditd SOCKADDR. Mobile ref T1428.
ev-0003 (Phase 4 detection lab - detonation runs 2026-09-28) — Lab detonation run-2026-09-28-001 (detected): Wazuh rule(s) 100301 fired on T1021 within the detonation window
Mobile-adjacent: Android Debug Bridge (adb) network connection on TCP 5555. Mobile ref T1428.
ev-0004 (Phase 4 detection lab - detonation runs 2026-09-29) — Lab detonation run-2026-09-29-001 (detected): Wazuh rule(s) 100311 fired on T1021 within the detonation window
Mobile-adjacent (Linux): Android Debug Bridge (adb) connect() to TCP 5555, from auditd SOCKADDR. Mobile ref T1428.