For a vulnerability being exploited right now, what do we actually know about detecting it?
kevmap joins CISA's Known Exploited Vulnerabilities catalogue to ATT&CK techniques, MITRE's detection strategies and log sources, and SigmaHQ rules — and shows, without guessing, where that chain breaks.
Mapped = 424 of 1748 (24.3%), from CTID Mappings Explorer pinned to KEV 2025-07-28 and ATT&CK 16.1, counting any mapping type. Counting only exploitation_technique: 410 (23.5%). Definitions.
357 CVEs have been added to KEV since the mapping snapshot of 2025-07-28. 0 of them have a mapping. The authoritative CVE → ATT&CK source is not keeping pace with the catalogue it describes. kevmap shows those entries as unmapped rather than filling the gap with inference — the obvious way to fill it produces noise.
What works: technique → detection
ATT&CK v20.0 publishes a detection strategy for 703 of 706 live techniques, through 1770 analytics naming 4206 concrete log source / channel pairs across 266 log sources. SigmaHQ adds 3323 rules tagged to 400 techniques. That half of the chain is dense, current and machine-checkable; the site traverses it exactly.
What is missing: CVE → technique
One public source maps KEV CVEs to ATT&CK: CTID's Mappings Explorer, 424 CVEs, last updated for KEV 2025-07-28 against ATT&CK 16.1. CISA's catalogue carries no technique field. CVE records carry CWE (1573 of 1748 KEV entries do) but CWE does not say how a thing is exploited, and the CAPEC bridge people use to pretend otherwise has not been updated since 2023-01-24.
Mapped but uncovered
Techniques that at least one KEV CVE maps to, for which MITRE publishes a detection strategy, and for which SigmaHQ has no rule. If you write detections, start here.
| Technique | Tactics | KEV CVEs | MITRE analytics |
|---|---|---|---|
| T1608.001 Upload Malware | resource development | 11 | 1 |
| T1011 Exfiltration Over Other Network Medium | exfiltration | 4 | 3 |
| T1497 Virtualization/Sandbox Evasion | stealth, discovery | 4 | 3 |
| T1037 Boot or Logon Initialization Scripts | persistence, privilege escalation | 3 | 5 |
| T1573.001 Symmetric Cryptography | command and control | 3 | 5 |
| T1001 Data Obfuscation | command and control | 2 | 3 |
| T1499.002 Service Exhaustion Flood | impact | 2 | 4 |
| T1530 Data from Cloud Storage | collection | 2 | 3 |
| T1584.005 Botnet | resource development | 2 | 1 |
| T1592 Gather Victim Host Information | reconnaissance | 2 | 1 |
| T1003.008 /etc/passwd and /etc/shadow | credential access | 1 | 1 |
| T1071.002 File Transfer Protocols | command and control | 1 | 5 |
Recently added to KEV
| Added | CVE | Vendor / product | State | Sigma |
|---|---|---|---|---|
| 2026-10-16 | CVE-2026-102764 | BeyondTrust Remote Support | Unmapped | |
| 2026-10-16 | CVE-2025-61624 | Fortinet Multiple Products | Unmapped | |
| 2026-10-15 | CVE-2026-21589 | Atlassian Multiple Products | Unmapped | |
| 2026-10-14 | CVE-2026-76519 | Cisco Secure Email Gateway | Unmapped | |
| 2026-10-14 | CVE-2026-105134 | Ahsay AhsayCBS | Unmapped | |
| 2026-10-14 | CVE-2026-105133 | Ahsay AhsayCBS | Unmapped | |
| 2026-10-14 | CVE-2026-0322 | Palo Alto Networks PAN-OS | Unmapped | |
| 2026-10-13 | CVE-2026-96951 | Microsoft Windows | Unmapped | |
| 2026-10-13 | CVE-2026-104935 | Ivanti Connect Secure | Unmapped | |
| 2026-10-08 | CVE-2023-22894 | Strapi Strapi | Unmapped | |
| 2026-10-08 | CVE-2021-3199 | ONLYOFFICE Docs | Unmapped | |
| 2026-10-08 | CVE-2016-3081 | Apache Struts | Unmapped | |
| 2026-10-08 | CVE-2015-5477 | ISC BIND | Unmapped | |
| 2026-10-08 | CVE-2015-3306 | ProFTPD ProFTPD | Unmapped | |
| 2026-10-04 | CVE-2026-88779 | Citrix NetScaler | Unmapped | |
| 2026-10-02 | CVE-2026-102490 | Zammad GmbH Zammad | Unmapped | |
| 2026-10-02 | CVE-2026-102489 | Zammad GmbH Zammad | Unmapped | |
| 2026-10-01 | CVE-2026-104286 | Fortinet FortiMail | Unmapped | |
| 2026-09-30 | CVE-2026-76504 | Cisco Catalyst SD-WAN Manager | Unmapped | |
| 2026-09-29 | CVE-2026-86950 | Apple Multiple Products | Unmapped |
Last 7 days (2026-10-11 → 2026-10-17): 9 added to KEV, 0 with an ATT&CK mapping, 0 with Sigma coverage via a mapped technique. Changes over time →