{"id":"T1133","name":"External Remote Services","url":"https://attack.mitre.org/techniques/T1133","tactics":["persistence","initial-access"],"platforms":["Containers","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0354","stix_id":"x-mitre-detection-strategy--e9833c3c-b5ec-421b-bab4-91f74c2b6bd1","name":"Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers","url":"https://attack.mitre.org/detectionstrategies/DET0354","analytics":[{"id":"AN1004","stix_id":"x-mitre-analytic--63583dcb-dbdc-4b9d-a261-3129de12327e","name":"Analytic 1004","description":"Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.","url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1004","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4776, 4625","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Application","channel":"VPN, Citrix, or remote access gateway logs showing external IP addresses","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"wineventlog-application"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"BusinessHours","description":"Normal business hours for logon activity."},{"field":"KnownRemoteIPs","description":"List of approved external IPs or VPN endpoints."},{"field":"FailedLogonThreshold","description":"Number of failed logons before raising suspicion (e.g., >5)."},{"field":"GeoIPWhitelist","description":"Geographic regions allowed for remote access."},{"field":"TimeWindow","description":"Time window to correlate failed attempts and success (e.g., 15m)."}],"live":true,"detection_strategies":["DET0354"],"techniques":["T1133"]},{"id":"AN1005","stix_id":"x-mitre-analytic--a3bca3ec-fd25-4b9d-bbce-9575ba96b8ef","name":"Analytic 1005","description":"Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).","url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1005","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"ssh logins or execve of remote commands","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"auditd-syscall"},{"name":"NSM:Connections","channel":"Failed password or accepted password for SSH users","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"nsm-connections"},{"name":"NSM:Flow","channel":"connection: Inbound connections to SSH or VPN ports","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"KnownSSHClients","description":"Legitimate IPs or client fingerprints for SSH/VPN."},{"field":"FailedLogonThreshold","description":"Number of failed SSH logins to trigger alert."},{"field":"TimeWindow","description":"Correlation window for failed attempts and success."}],"live":true,"detection_strategies":["DET0354"],"techniques":["T1133"]},{"id":"AN1006","stix_id":"x-mitre-analytic--14f4930e-a2a5-45ae-9552-837c0a35e06b","name":"Analytic 1006","description":"Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.","url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1006","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Remote login (ssh) or screen sharing authentication attempts","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Inbound connections to VNC/SSH ports","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"macos-unifiedlog"},{"name":"PF:Logs","channel":"External traffic to remote access services","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"pf-logs"}],"mutable_elements":[{"field":"KnownVNCServers","description":"List of approved VNC/SSH sources."},{"field":"TimeWindow","description":"Time correlation between failed attempts and success."}],"live":true,"detection_strategies":["DET0354"],"techniques":["T1133"]},{"id":"AN1007","stix_id":"x-mitre-analytic--04fcf3d4-4547-4e64-bbb7-9faa46dda1f6","name":"Analytic 1007","description":"Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.","url":"https://attack.mitre.org/detectionstrategies/DET0354#AN1007","platforms":["Containers"],"log_source_references":[{"name":"ApplicationLog:API","channel":"Docker/Kubernetes API access from external sources","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"applicationlog-api"},{"name":"kubernetes:audit","channel":"Unauthorized container creation or kubelet exec logs","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"kubernetes-audit"},{"name":"NSM:Flow","channel":"External access to container ports (2375, 6443)","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"AllowedCIDRs","description":"Approved external IP ranges for container APIs."},{"field":"TimeWindow","description":"Correlation window for API calls and container starts."}],"live":true,"detection_strategies":["DET0354"],"techniques":["T1133"]}],"live":true,"version":"1.0","techniques":["T1133"]}],"sigma_rules":[{"id":"1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d","title":"Remote Access Tool - Team Viewer Session Started On Linux Host","author":"Josh Nickels, Qi Nan","status":"test","level":"low","date":"2024-03-11","modified":null,"description":"Detects the command line executed when TeamViewer starts a session started by a remote host.\nOnce a connection has been started, an investigator can verify the connection details by viewing the \"incoming_connections.txt\" log file in the TeamViewer folder.\n","references":["Internal Research"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.persistence","attack.initial-access","attack.t1133"],"path":"rules/linux/process_creation/proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.yml","techniques":["T1133"],"cves":[]},{"id":"259a9cdf-c4dd-4fa2-b243-2269e5ab18a2","title":"External Remote RDP Logon from Public IP","author":"Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)","status":"test","level":"medium","date":"2023-01-19","modified":"2024-03-11","description":"Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.","references":["https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html","https://twitter.com/Purp1eW0lf/status/1616144561965002752"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.credential-access","attack.stealth","attack.t1133","attack.t1078","attack.t1110"],"path":"rules/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml","techniques":["T1133","T1078","T1110"],"cves":[]},{"id":"2bfb6216-0c31-4d20-8501-2629b29a3fa2","title":"FortiGate - New VPN SSL Web Portal Added","author":"Marco Pedrinazzi (@pedrinazziM) (InTheCyber)","status":"experimental","level":"medium","date":"2025-11-01","modified":null,"description":"Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall.\nThis behavior was observed in pair with modification of VPN SSL settings.\n","references":["https://www.fortiguard.com/psirt/FG-IR-24-535","https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event","https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal","https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr"],"logsource":{"product":"fortigate","service":"event"},"tags":["attack.persistence","attack.initial-access","attack.t1133"],"path":"rules/network/fortinet/fortigate/fortinet_fortigate_new_vpn_ssl_web_portal.yml","techniques":["T1133"],"cves":[]},{"id":"512cff7a-683a-43ad-afe0-dd398e872f36","title":"OpenCanary - Telnet Login Attempt","author":"Security Onion Solutions","status":"test","level":"high","date":"2024-03-08","modified":null,"description":"Detects instances where a Telnet service on an OpenCanary node has had a login attempt.","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.command-and-control","attack.stealth","attack.t1133","attack.t1078"],"path":"rules/application/opencanary/opencanary_telnet_login_attempt.yml","techniques":["T1133","T1078"],"cves":[]},{"id":"598290cf-5932-45cd-9123-be1e05ab4f2e","title":"OpenCanary - RDP New Connection Attempt","author":"Marco Pedrinazzi (@pedrinazziM)","status":"experimental","level":"high","date":"2026-01-06","modified":null,"description":"Detects instances where an RDP service on an OpenCanary node has had a connection attempt.","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.initial-access","attack.lateral-movement","attack.persistence","attack.t1133","attack.t1021.001"],"path":"rules/application/opencanary/opencanary_rdp_connection_attempt.yml","techniques":["T1133","T1021.001"],"cves":[]},{"id":"6c76b3d0-afe4-4870-9443-ffe6773c5fef","title":"Potential Exploitation of GoAnywhere MFT Vulnerability","author":"MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-10-07","modified":null,"description":"Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035.\nThis behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.\n","references":["https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","attack.execution","attack.t1059.001","attack.persistence","attack.t1133","detection.emerging-threats","cve.2025-10035"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-10035/proc_creation_win_exploit_cve_2025_10035.yml","techniques":["T1190","T1059.001","T1133"],"cves":["CVE-2025-10035"]},{"id":"75bfe6e6-cd8e-429e-91d3-03921e1d7962","title":"Remote Access Tool - ScreenConnect Installation Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2021-02-11","modified":"2024-02-26","description":"Detects ScreenConnect program starts that establish a remote access to a system.","references":["https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.initial-access","attack.t1133"],"path":"rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_installation_cli_param.yml","techniques":["T1133"],"cves":[]},{"id":"78d5cab4-557e-454f-9fb9-a222bd0d5edc","title":"External Remote SMB Logon from Public IP","author":"Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)","status":"test","level":"high","date":"2023-01-19","modified":"2024-03-11","description":"Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.","references":["https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html","https://twitter.com/Purp1eW0lf/status/1616144561965002752"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.credential-access","attack.stealth","attack.t1133","attack.t1078","attack.t1110"],"path":"rules/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml","techniques":["T1133","T1078","T1110"],"cves":[]},{"id":"8b5dacf2-aeb7-459d-b133-678eb696d410","title":"FortiGate - VPN SSL Settings Modified","author":"Marco Pedrinazzi (@pedrinazziM) (InTheCyber)","status":"experimental","level":"medium","date":"2025-11-01","modified":null,"description":"Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).\nThis behavior was observed in pair with the addition of a VPN SSL Web Portal.\n","references":["https://www.fortiguard.com/psirt/FG-IR-24-535","https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event","https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/114404382/config-vpn-ssl-settings","https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44546/44546-logid-event-config-attr"],"logsource":{"product":"fortigate","service":"event"},"tags":["attack.persistence","attack.initial-access","attack.t1133"],"path":"rules/network/fortinet/fortigate/fortinet_fortigate_vpn_ssl_settings_modified.yml","techniques":["T1133"],"cves":[]},{"id":"8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0","title":"Unusual File Deletion by Dns.exe","author":"Tim Rauch (Nextron Systems), Elastic (idea)","status":"test","level":"high","date":"2022-09-27","modified":"2023-02-15","description":"Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)","references":["https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html"],"logsource":{"product":"windows","category":"file_delete"},"tags":["attack.persistence","attack.initial-access","attack.t1133"],"path":"rules/windows/file/file_delete/file_delete_win_unusual_deletion_by_dns_exe.yml","techniques":["T1133"],"cves":[]},{"id":"9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3","title":"Unusual File Modification by dns.exe","author":"Tim Rauch (Nextron Systems), Elastic (idea)","status":"test","level":"high","date":"2022-09-27","modified":null,"description":"Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)","references":["https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html"],"logsource":{"product":"windows","category":"file_change"},"tags":["attack.persistence","attack.initial-access","attack.t1133"],"path":"rules/windows/file/file_change/file_change_win_unusual_modification_by_dns_exe.yml","techniques":["T1133"],"cves":[]},{"id":"a4e3d776-f12e-42c2-8510-9e6ed1f43ec3","title":"Unusual Child Process of dns.exe","author":"Tim Rauch, Elastic (idea)","status":"test","level":"high","date":"2022-09-27","modified":"2023-02-05","description":"Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)","references":["https://www.elastic.co/guide/en/security/current/unusual-child-process-of-dns-exe.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.initial-access","attack.t1133"],"path":"rules/windows/process_creation/proc_creation_win_dns_susp_child_process.yml","techniques":["T1133"],"cves":[]},{"id":"ab70c354-d9ac-4e11-bbb6-ec8e3b153357","title":"Remote Access Tool - Team Viewer Session Started On Windows Host","author":"Josh Nickels, Qi Nan","status":"test","level":"low","date":"2024-03-11","modified":null,"description":"Detects the command line executed when TeamViewer starts a session started by a remote host.\nOnce a connection has been started, an investigator can verify the connection details by viewing the \"incoming_connections.txt\" log file in the TeamViewer folder.\n","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.initial-access","attack.t1133"],"path":"rules/windows/process_creation/proc_creation_win_remote_access_tools_teamviewer_incoming_connection.yml","techniques":["T1133"],"cves":[]},{"id":"b64a026b-8deb-4c1d-92fd-98893209dff1","title":"Running Chrome VPN Extensions via the Registry 2 VPN Extension","author":"frack113","status":"test","level":"high","date":"2021-12-28","modified":"2023-08-17","description":"Running Chrome VPN Extensions via the Registry install 2 vpn extension","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1133/T1133.md#atomic-test-1---running-chrome-vpn-extensions-via-the-registry-2-vpn-extension"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.initial-access","attack.persistence","attack.t1133"],"path":"rules/windows/registry/registry_set/registry_set_chrome_extension.yml","techniques":["T1133"],"cves":[]},{"id":"cd55f721-5623-4663-bd9b-5229cab5237d","title":"OpenCanary - SSH New Connection Attempt","author":"Security Onion Solutions","status":"test","level":"high","date":"2024-03-08","modified":null,"description":"Detects instances where an SSH service on an OpenCanary node has had a connection attempt.","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.privilege-escalation","attack.initial-access","attack.lateral-movement","attack.persistence","attack.stealth","attack.t1133","attack.t1021","attack.t1078"],"path":"rules/application/opencanary/opencanary_ssh_new_connection.yml","techniques":["T1133","T1021","T1078"],"cves":[]},{"id":"e890acee-d488-420e-8f20-d9b19b3c3d43","title":"Suspicious File Created by ArcSOC.exe","author":"Micah Babinski","status":"experimental","level":"high","date":"2025-11-25","modified":null,"description":"Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS\nserver, creates a file with suspicious file type, indicating that it may be an executable, script file,\nor otherwise unusual.\n","references":["https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/","https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.command-and-control","attack.persistence","attack.initial-access","attack.execution","attack.stealth","attack.t1127","attack.t1105","attack.t1133"],"path":"rules/windows/file/file_event/file_event_win_arcsoc_susp_file_created.yml","techniques":["T1127","T1105","T1133"],"cves":[]},{"id":"f459ccb4-9805-41ea-b5b2-55e279e2424a","title":"Remote Access Tool - Team Viewer Session Started On MacOS Host","author":"Josh Nickels, Qi Nan","status":"test","level":"low","date":"2024-03-11","modified":null,"description":"Detects the command line executed when TeamViewer starts a session started by a remote host.\nOnce a connection has been started, an investigator can verify the connection details by viewing the \"incoming_connections.txt\" log file in the TeamViewer folder.\n","references":["Internal Research"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.persistence","attack.initial-access","attack.t1133"],"path":"rules/macos/process_creation/proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.yml","techniques":["T1133"],"cves":[]},{"id":"f88e112a-21aa-44bd-9b01-6ee2a2bbbed1","title":"Failed Logon From Public IP","author":"NVISO","status":"test","level":"medium","date":"2020-05-06","modified":"2024-03-11","description":"Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078","attack.t1190","attack.t1133"],"path":"rules/windows/builtin/security/account_management/win_security_susp_failed_logon_source.yml","techniques":["T1078","T1190","T1133"],"cves":[]},{"id":"ff7139bc-fdb1-4437-92f2-6afefe8884cb","title":"OpenCanary - SSH Login Attempt","author":"Security Onion Solutions","status":"test","level":"high","date":"2024-03-08","modified":null,"description":"Detects instances where an SSH service on an OpenCanary node has had a login attempt.","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.privilege-escalation","attack.initial-access","attack.lateral-movement","attack.persistence","attack.stealth","attack.t1133","attack.t1021","attack.t1078"],"path":"rules/application/opencanary/opencanary_ssh_login_attempt.yml","techniques":["T1133","T1021","T1078"],"cves":[]},{"id":"ffa28e60-bdb1-46e0-9f82-05f7a61cc06e","title":"User Added to Remote Desktop Users Group","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-12-06","modified":"2022-09-09","description":"Detects addition of users to the local Remote Desktop Users group via \"Net\" or \"Add-LocalGroupMember\".","references":["https://www.microsoft.com/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.persistence","attack.lateral-movement","attack.t1133","attack.t1136.001","attack.t1021.001"],"path":"rules/windows/process_creation/proc_creation_win_susp_add_user_remote_desktop_group.yml","techniques":["T1133","T1136.001","T1021.001"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2023-39780","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-32756","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-11120","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-45195","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-48365","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-20269","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-27532","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-20699","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2014-6271","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2014-7169","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2018-4939","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2019-3396","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-1497","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-1498","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2019-19781","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2020-25506","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2020-8515","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2020-5902","state":"stale","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-22986","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2019-5591","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2019-0708","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2020-1472","state":"mapped","mapping_types":["exploitation_technique","secondary_impact"]},{"cveID":"CVE-2021-26855","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-26857","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2019-11510","state":"mapped","mapping_types":["exploitation_technique"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}