{"id":"T1046","name":"Network Service Discovery","url":"https://attack.mitre.org/techniques/T1046","tactics":["discovery"],"platforms":["Containers","IaaS","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0376","stix_id":"x-mitre-detection-strategy--82e20b1f-300e-43cc-9259-1d506ef5d1f8","name":"Behavioral Detection Strategy for Network Service Discovery Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0376","analytics":[{"id":"AN1057","stix_id":"x-mitre-analytic--84299e85-2a7e-4f78-9767-3d29aa58857a","name":"Analytic 1057","description":"Detects processes performing network enumeration (e.g., port scans, service probing) by correlating process creation, socket connections, and sequential destination IP probing within a time window.","url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1057","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ScanRateThreshold","description":"Defines the number of unique destination IPs or ports accessed within a time window that may indicate a scan."},{"field":"KnownScannerExeList","description":"List of binaries allowed to scan or used by IT (e.g., Nmap, Nessus)."},{"field":"TimeWindow","description":"Temporal bounds for correlating sequential connections (e.g., 60 seconds)."}],"live":true,"detection_strategies":["DET0376"],"techniques":["T1046"]},{"id":"AN1058","stix_id":"x-mitre-analytic--287661d0-714e-4bb4-a9f7-c272ad0018b1","name":"Analytic 1058","description":"Detects use of network scanning utilities or scripts performing rapid connections to multiple services or hosts using auditd and netflow/pcap telemetry.","url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1058","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"Outbound TCP SYN or UDP to multiple ports/hosts","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"PortScanThreshold","description":"Defines number of ports targeted per host within a short period."},{"field":"ToolPatternRegex","description":"Regex to match common scanner arguments (e.g., `nmap -sS`, `nc -zv`)."},{"field":"ExpectedScanSources","description":"Trusted IPs or systems performing routine discovery."}],"live":true,"detection_strategies":["DET0376"],"techniques":["T1046"]},{"id":"AN1059","stix_id":"x-mitre-analytic--28fbe1b0-9663-4997-9d4e-ef43803be114","name":"Analytic 1059","description":"Detects Bonjour-based mDNS enumeration or use of system tools (e.g., dns-sd, nmap) to find active services via multicast probing or targeted scans.","url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1059","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"dns-sd, mDNSResponder, socket activity","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"process_events","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"MDNSServiceQueryPatterns","description":"mDNS queries such as _ssh._tcp.local that may indicate service discovery."},{"field":"UserContext","description":"Adjust alerting based on whether discovery activity originates from a background daemon vs. interactive session."},{"field":"ScanToolList","description":"Expected tools that could trigger mDNS or TCP/UDP scans (e.g., dns-sd, nmap)."}],"live":true,"detection_strategies":["DET0376"],"techniques":["T1046"]},{"id":"AN1060","stix_id":"x-mitre-analytic--5d7b1be3-1c8a-40bf-a4d2-85e26dd82d76","name":"Analytic 1060","description":"Detects lateral discovery or container breakout attempts using netcat, curl, or custom binaries probing other services within the same namespace or VPC subnet.","url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1060","platforms":["Containers"],"log_source_references":[{"name":"ebpf:syscalls","channel":"socket connect","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"ebpf-syscalls"},{"name":"ebpf:syscalls","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"ebpf-syscalls"},{"name":"containerd:runtime","channel":"container-level outbound traffic events","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"containerd-runtime"}],"mutable_elements":[{"field":"ExecutablePath","description":"Custom or renamed versions of tools may use different paths"},{"field":"TimeWindow","description":"Aggregation interval for identifying anomalous traffic"},{"field":"NetworkDestinationCount","description":"Tunable count of unique destinations to classify discovery"}],"live":true,"detection_strategies":["DET0376"],"techniques":["T1046"]}],"live":true,"version":"1.0","techniques":["T1046"]}],"sigma_rules":[{"id":"3761e026-f259-44e6-8826-719ed8079408","title":"Linux Network Service Scanning - Auditd","author":"Alejandro Ortuno, oscd.community","status":"test","level":"low","date":"2020-10-21","modified":"2023-09-26","description":"Detects enumeration of local or remote network services.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.discovery","attack.t1046"],"path":"rules/linux/auditd/syscall/lnx_auditd_network_service_scanning.yml","techniques":["T1046"],"cves":[]},{"id":"3e102cd9-a70d-4a7a-9508-403963092f31","title":"Linux Network Service Scanning Tools Execution","author":"Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])","status":"test","level":"low","date":"2020-10-21","modified":"2024-09-19","description":"Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md","https://github.com/projectdiscovery/naabu","https://github.com/Tib3rius/AutoRecon"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1046"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_network_utilities_execution.yml","techniques":["T1046"],"cves":[]},{"id":"4fd6b1c7-19b8-4488-97f6-00f0924991a3","title":"PUA - NimScan Execution","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"medium","date":"2025-02-05","modified":null,"description":"Detects usage of NimScan, a portscanner utility.\nIn early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.\nThis rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.\n","references":["https://x.com/cyberfeeddigest/status/1887041526397587859","https://github.com/elddy/NimScan"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1046"],"path":"rules/windows/process_creation/proc_creation_win_pua_nimscan.yml","techniques":["T1046"],"cves":[]},{"id":"54773c5f-f1cc-4703-9126-2f797d96a69d","title":"PUA - Advanced Port Scanner Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2021-12-18","modified":"2023-02-07","description":"Detects the use of Advanced Port Scanner.","references":["https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20Port%20Scanner"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1046","attack.t1135"],"path":"rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner.yml","techniques":["T1046","T1135"],"cves":[]},{"id":"68b8547b-107f-43f3-97fb-900a7d63c190","title":"OpenCanary - NMAP NULL Scan","author":"Marco Pedrinazzi (@pedrinazziM)","status":"experimental","level":"high","date":"2026-01-06","modified":null,"description":"Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.discovery","attack.t1046"],"path":"rules/application/opencanary/opencanary_portscan_nmap_null_scan.yml","techniques":["T1046"],"cves":[]},{"id":"84bae5d4-b518-4ae0-b331-6d4afd34d00f","title":"MacOS Network Service Scanning","author":"Alejandro Ortuno, oscd.community","status":"test","level":"low","date":"2020-10-21","modified":"2021-11-27","description":"Detects enumeration of local or remote network services.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.discovery","attack.t1046"],"path":"rules/macos/process_creation/proc_creation_macos_network_service_scanning.yml","techniques":["T1046"],"cves":[]},{"id":"851fd622-b675-4d26-b803-14bc7baa517a","title":"HackTool - WinPwn Execution - ScriptBlock","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"974be8d2-283e-4033-ab08-7505b84204d0","title":"OpenCanary - Host Port Scan (SYN Scan)","author":"Marco Pedrinazzi (@pedrinazziM)","status":"experimental","level":"high","date":"2026-01-06","modified":null,"description":"Detects instances where an OpenCanary node has been targeted by a SYN port scan.","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.discovery","attack.t1046"],"path":"rules/application/opencanary/opencanary_portscan_syn_scan.yml","techniques":["T1046"],"cves":[]},{"id":"97de11cd-4b67-4abf-9a8b-1020e670aa9e","title":"Pnscan Binary Data Transmission Activity","author":"David Burkett (@signalblur)","status":"test","level":"medium","date":"2024-04-16","modified":null,"description":"Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network.\nThis behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT\n","references":["https://www.cadosecurity.com/blog/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence","https://intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf","https://regex101.com/r/RugQYK/1","https://www.virustotal.com/gui/file/beddf70a7bab805f0c0b69ac0989db6755949f9f68525c08cb874988353f78a9/content"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1046"],"path":"rules/linux/process_creation/proc_creation_lnx_pnscan_binary_cli_pattern.yml","techniques":["T1046"],"cves":[]},{"id":"98b53e78-ebaf-46f8-be06-421aafd176d9","title":"HackTool - winPEAS Execution","author":"Georg Lauenstein (sure[secure])","status":"test","level":"high","date":"2022-09-19","modified":"2023-03-23","description":"WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz","references":["https://github.com/carlospolop/PEASS-ng","https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.discovery","attack.t1082","attack.t1087","attack.t1046"],"path":"rules/windows/process_creation/proc_creation_win_hktl_winpeas.yml","techniques":["T1082","T1087","T1046"],"cves":[]},{"id":"af688c76-4ce4-4309-bfdd-e896f01acf27","title":"Grixba Malware Reconnaissance Activity","author":"yxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-26","modified":null,"description":"Detects execution of the Grixba reconnaissance tool based on suspicious command-line parameter combinations.\nThis tool is used by the Play ransomware group for network enumeration, data gathering, and event log clearing.\n","references":["https://fieldeffect.com/blog/grixba-play-ransomware-impersonates-sentinelone","https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.reconnaissance","attack.t1595.001","attack.discovery","attack.t1046","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Malware/Grixba/proc_creation_win_malware_grixba_recon.yml","techniques":["T1595.001","T1046"],"cves":[]},{"id":"bef0bc5a-b9ae-425d-85c6-7b2d705980c6","title":"Python Initiated Connection","author":"frack113","status":"test","level":"medium","date":"2021-12-10","modified":"2025-03-05","description":"Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-4---port-scan-using-python","https://pypi.org/project/scapy/"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.discovery","attack.t1046"],"path":"rules/windows/network_connection/net_connection_win_python.yml","techniques":["T1046"],"cves":[]},{"id":"bef37fa2-f205-4a7b-b484-0759bfd5f86f","title":"PUA - Advanced IP Scanner Execution","author":"Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy","status":"test","level":"medium","date":"2020-05-12","modified":"2023-02-07","description":"Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.","references":["https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/","https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html","https://labs.f-secure.com/blog/prelude-to-ransomware-systembc","https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf","https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer","https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20IP%20Scanner"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1046","attack.t1135"],"path":"rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner.yml","techniques":["T1046","T1135"],"cves":[]},{"id":"ca387a8e-1c84-4da3-9993-028b45342d30","title":"PUA - SoftPerfect Netscan Execution","author":"@d4ns4n_ (Wuerth-Phoenix)","status":"test","level":"medium","date":"2024-04-25","modified":null,"description":"Detects usage of SoftPerfect's \"netscan.exe\". An application for scanning networks.\nIt is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.\n","references":["https://www.protect.airbus.com/blog/uncovering-cyber-intruders-netscan/","https://secjoes-reports.s3.eu-central-1.amazonaws.com/Sockbot%2Bin%2BGoLand.pdf","https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-ransomware-attacks-continue","https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/","https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/","https://www.softperfect.com/products/networkscanner/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1046"],"path":"rules/windows/process_creation/proc_creation_win_pua_netscan.yml","techniques":["T1046"],"cves":[]},{"id":"d557dc06-62e8-4468-a8e8-7984124908ce","title":"HackTool - WinPwn Execution","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"d7553d7b-f485-479c-b192-cdac6edd83a4","title":"OpenCanary - NMAP XMAS Scan","author":"Marco Pedrinazzi (@pedrinazziM)","status":"experimental","level":"high","date":"2026-01-06","modified":null,"description":"Detects instances where an OpenCanary node has been targeted by a NMAP XMAS Scan","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.discovery","attack.t1046"],"path":"rules/application/opencanary/opencanary_portscan_nmap_xmas_scan.yml","techniques":["T1046"],"cves":[]},{"id":"e8a677fd-248c-4eab-94df-de2f6f645884","title":"OpenCanary - NMAP OS Scan","author":"Marco Pedrinazzi (@pedrinazziM)","status":"experimental","level":"high","date":"2026-01-06","modified":null,"description":"Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.discovery","attack.t1046"],"path":"rules/application/opencanary/opencanary_portscan_nmap_os_scan.yml","techniques":["T1046"],"cves":[]},{"id":"eae8c0c8-e5da-450a-9d7d-66aa56cd26b6","title":"OpenCanary - NMAP FIN Scan","author":"Marco Pedrinazzi (@pedrinazziM)","status":"experimental","level":"high","date":"2026-01-06","modified":null,"description":"Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.discovery","attack.t1046"],"path":"rules/application/opencanary/opencanary_portscan_nmap_fin_scan.yml","techniques":["T1046"],"cves":[]},{"id":"f6ecd1cf-19b8-4488-97f6-00f0924991a3","title":"PUA - Nmap/Zenmap Execution","author":"frack113","status":"test","level":"medium","date":"2021-12-10","modified":"2023-12-11","description":"Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation","references":["https://nmap.org/","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-3---port-scan-nmap-for-windows"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1046"],"path":"rules/windows/process_creation/proc_creation_win_pua_nmap_zenmap.yml","techniques":["T1046"],"cves":[]},{"id":"fed85bf9-e075-4280-9159-fbe8a023d6fa","title":"Advanced IP Scanner - File Event","author":"@ROxPinTeddy","status":"test","level":"medium","date":"2020-05-12","modified":"2022-11-29","description":"Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.","references":["https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/","https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html","https://labs.f-secure.com/blog/prelude-to-ransomware-systembc","https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf","https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.discovery","attack.t1046"],"path":"rules/windows/file/file_event/file_event_win_advanced_ip_scanner.yml","techniques":["T1046"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-32756","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2025-0282","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-38035","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-26360","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-21973","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2019-13608","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2019-11634","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}