Become a Beta Tester

DocsAttack Types

Remote-Service Abuse

Scanning for exposed remote-access and database services.

A VM searches the internet for exposed remote-access and database services (SSH, RDP, databases) to attack them. Frabs counts how many hosts each VM tries on those service ports.

Detectors (13)

DetectorMeasuresWarningIncidentCritical
SSH ScanningDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min
RDP ScanningDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min
FTP ScanningDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min
Telnet ScanningDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min
VNC ScanningDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min
SMB ScanningDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min
WinRM ScanningDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min
Database ScanningDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min
Redis ScanningDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min
Elasticsearch ScanningDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min
Docker API ScanningDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min
Kubernetes API ScanningDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min
Remote Service EnumerationDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min

Change the thresholds

Use Custom Protection to change any of these, or set them for one VM. See Detectors and Thresholds.