Log sources › AWS:VPCFlowLogs
AWS:VPCFlowLogs
Inverted view: what can be detected if this is the log you have. IaaS
16
channels
16
analytics
16
techniques
177
KEV CVEs reachable
"Reachable" means: a KEV CVE has a public mapping to a technique, and MITRE's analytic for that technique names this log source. It is a statement about published knowledge, not about whether any particular rule fires.
Channels
| Channel | Data components | Analytics | Techniques |
|---|---|---|---|
High outbound traffic from new region resource |
DC0082 Network Connection Creation | AN0690 | 1 |
High volume internal-to-internal IP transfer or cross-account cloud transfer |
DC0085 Network Traffic Content | AN1580 | 1 |
Large outbound UDP traffic to multiple public reflector IPs |
DC0078 Network Traffic Flow | AN1143 | 1 |
Large transfer volume (>20MB) from RDS IP range to external public IPs |
DC0082 Network Connection Creation | AN0679 | 1 |
Large volume of malformed or synthetic payloads to application endpoints prior to failure |
DC0085 Network Traffic Content | AN0853 | 1 |
Outbound connection to 169.254.169.254 from EC2 workload |
DC0082 Network Connection Creation | AN0001 | 1 |
Outbound connections to port 22, 3389 |
DC0082 Network Connection Creation | AN0753 | 1 |
Outbound data flows |
DC0078 Network Traffic Flow | AN0370 | 1 |
Outbound flow logs to known mining pools |
DC0078 Network Traffic Flow | AN0744 | 1 |
Traffic between instances |
DC0085 Network Traffic Content | AN0198 | 1 |
Traffic observed on mirror destination instance |
DC0082 Network Connection Creation | AN1131 | 1 |
Unusual volume of data transferred from S3 storage endpoints to non-corporate IPs |
DC0085 Network Traffic Content | AN1328 | 1 |
Unusual volume of inbound packets from single source across short time interval |
DC0078 Network Traffic Flow | AN0492 | 1 |
VPC/NSG flow logs for pod/instance egress to Internet or metadata |
DC0078 Network Traffic Flow | AN0223 | 1 |
egress > 90th percentile or frequent connection reuse |
DC0078 Network Traffic Flow | AN0084 | 1 |
source instance sends large volume of traffic in short window |
DC0078 Network Traffic Flow | AN0972 | 1 |
Techniques detectable from this source
| Technique | Tactics | Sigma rules | KEV CVEs |
|---|---|---|---|
| T1020.001 Traffic Duplication | exfiltration | 0 | 0 |
| T1021 Remote Services | lateral movement | 11 | 4 |
| T1048 Exfiltration Over Alternative Protocol | exfiltration | 12 | 4 |
| T1074.002 Remote Data Staging | collection | 0 | 0 |
| T1190 Exploit Public-Facing Application | initial access | 149 | 157 |
| T1213.006 Databases | collection | 0 | 0 |
| T1496 Resource Hijacking | impact | 13 | 19 |
| T1496.002 Bandwidth Hijacking | impact | 0 | 0 |
| T1498.001 Direct Network Flood | impact | 0 | 1 |
| T1498.002 Reflection Amplification | impact | 0 | 0 |
| T1499.002 Service Exhaustion Flood | impact | 0 | 2 |
| T1499.004 Application or System Exploitation | impact | 3 | 2 |
| T1530 Data from Cloud Storage | collection | 0 | 2 |
| T1535 Unused/Unsupported Cloud Regions | stealth | 0 | 0 |
| T1537 Transfer Data to Cloud Account | exfiltration | 6 | 0 |
| T1552.005 Cloud Instance Metadata API | credential access | 0 | 0 |
KEV CVEs reachable from this source
| CVE | Vendor / product | Via technique | State |
|---|---|---|---|
| CVE-2009-3960 | Adobe BlazeDS | T1190 | Mapped |
| CVE-2010-2861 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2013-0625 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2013-0629 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2013-0631 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2013-0632 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2013-0641 | Adobe Reader | T1048 | Mapped |
| CVE-2014-6271 | GNU Bourne-Again Shell (Bash) | T1190 | Mapped |
| CVE-2014-7169 | GNU Bourne-Again Shell (Bash) | T1190 | Mapped |
| CVE-2015-3043 | Adobe Flash Player | T1499.004 | Mapped |
| CVE-2016-10033 | PHP PHPMailer | T1190 | Mapped |
| CVE-2016-4437 | Apache Shiro | T1190 | Mapped |
| CVE-2017-12637 | SAP NetWeaver | T1190 | Mapped |
| CVE-2017-5638 | Apache Struts | T1190 | Mapped |
| CVE-2017-6742 | Cisco IOS and IOS XE Software | T1048 | Mapped |
| CVE-2017-9805 | Apache Struts | T1190 | Mapped |
| CVE-2017-9822 | DotNetNuke (DNN) DotNetNuke (DNN) | T1190 T1496 | Mapped |
| CVE-2018-11776 | Apache Struts | T1190 T1496 | Mapped |
| CVE-2018-13379 | Fortinet FortiOS | T1190 | Mapped |
| CVE-2018-15961 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2018-4939 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2018-6789 | Exim Exim | T1190 | Mapped |
| CVE-2018-7600 | Drupal Drupal Core | T1190 T1496 | Mapped |
| CVE-2019-0604 | Microsoft SharePoint | T1190 | Mapped |
| CVE-2019-11634 | Citrix Workspace Application and Receiver for Windows | T1190 | Mapped |
| CVE-2019-1653 | Cisco Small Business RV320 and RV325 Routers | T1190 | Mapped |
| CVE-2019-17558 | Apache Solr | T1190 | Mapped |
| CVE-2019-18935 | Progress Telerik UI for ASP.NET AJAX | T1190 T1496 | Mapped |
| CVE-2020-0688 | Microsoft Exchange Server | T1190 | Mapped |
| CVE-2020-1472 | Microsoft Netlogon | T1021 | Mapped |
| CVE-2020-15505 | Ivanti MobileIron Multiple Products | T1190 | Mapped |
| CVE-2020-17530 | Apache Struts | T1190 | Mapped |
| CVE-2020-29557 | D-Link DIR-825 R1 Devices | T1190 | Mapped |
| CVE-2020-5902 | F5 BIG-IP | T1190 | Stale |
| CVE-2020-8515 | DrayTek Multiple Vigor Routers | T1496 | Mapped |
| CVE-2021-21972 | VMware vCenter Server | T1190 | Mapped |
| CVE-2021-21973 | VMware vCenter Server and Cloud Foundation | T1190 | Mapped |
| CVE-2021-21975 | VMware vRealize Operations Manager API | T1190 | Mapped |
| CVE-2021-22005 | VMware vCenter Server | T1190 | Mapped |
| CVE-2021-22017 | VMware vCenter Server | T1190 | Mapped |
| CVE-2021-22204 | Perl Exiftool | T1190 | Mapped |
| CVE-2021-22205 | GitLab Community and Enterprise Editions | T1190 T1496 | Mapped |
| CVE-2021-22893 | Ivanti Pulse Connect Secure | T1190 | Mapped |
| CVE-2021-22986 | F5 BIG-IP and BIG-IQ Centralized Management | T1190 | Mapped |
| CVE-2021-26084 | Atlassian Confluence Server and Data Center | T1496 | Mapped |
| CVE-2021-26085 | Atlassian Confluence Server | T1190 | Mapped |
| CVE-2021-26858 | Microsoft Exchange Server | T1190 | Mapped |
| CVE-2021-27065 | Microsoft Exchange Server | T1190 | Mapped |
| CVE-2021-27102 | Accellion FTA | T1190 | Mapped |
| CVE-2021-27103 | Accellion FTA | T1190 | Mapped |
| CVE-2021-27104 | Accellion FTA | T1190 | Mapped |
| CVE-2021-27860 | FatPipe WARP, IPVPN, and MPVPN software | T1190 | Mapped |
| CVE-2021-31166 | Microsoft HTTP Protocol Stack | T1190 | Mapped |
| CVE-2021-3129 | Laravel Ignition | T1190 | Mapped |
| CVE-2021-34473 | Microsoft Exchange Server | T1190 | Mapped |
| CVE-2021-34523 | Microsoft Exchange Server | T1190 | Mapped |
| CVE-2021-35394 | Realtek Jungle Software Development Kit (SDK) | T1190 T1496 | Mapped |
| CVE-2021-35464 | ForgeRock Access Management (AM) | T1190 | Mapped |
| CVE-2021-36380 | Sunhillo SureLine | T1190 | Mapped |
| CVE-2021-37415 | Zoho ManageEngine ServiceDesk Plus (SDP) | T1190 | Mapped |
| CVE-2021-39144 | XStream XStream | T1190 | Mapped |
| CVE-2021-39226 | Grafana Labs Grafana | T1190 | Mapped |
| CVE-2021-40539 | Zoho ManageEngine | T1190 | Mapped |
| CVE-2021-40655 | D-Link DIR-605 Router | T1190 | Mapped |
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | T1190 | Mapped |
| CVE-2021-44228 | Apache Log4j2 | T1190 T1496 | Mapped |
| CVE-2021-44515 | Zoho Desktop Central | T1190 | Mapped |
| CVE-2021-44529 | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) | T1190 | Mapped |
| CVE-2021-45382 | D-Link Multiple Routers | T1190 T1499.002 | Mapped |
| CVE-2022-0028 | Palo Alto Networks PAN-OS | T1190 | Mapped |
| CVE-2022-1040 | Sophos Firewall | T1190 | Mapped |
| CVE-2022-20700 | Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers | T1190 | Mapped |
| CVE-2022-20708 | Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers | T1190 | Mapped |
| CVE-2022-20821 | Cisco IOS XR | T1190 | Mapped |
| CVE-2022-22947 | VMware Spring Cloud Gateway | T1190 | Mapped |
| CVE-2022-22963 | VMware Tanzu Spring Cloud | T1190 | Mapped |
| CVE-2022-22965 | VMware Spring Framework | T1190 | Mapped |
| CVE-2022-23131 | Zabbix Frontend | T1190 | Mapped |
| CVE-2022-24086 | Adobe Commerce and Magento Open Source | T1190 | Mapped |
| CVE-2022-26134 | Atlassian Confluence Server/Data Center | T1190 | Mapped |
| CVE-2022-26258 | D-Link DIR-820L | T1190 T1499.002 | Mapped |
| CVE-2022-26500 | Veeam Backup & Replication | T1048 T1190 | Mapped |
| CVE-2022-26501 | Veeam Backup & Replication | T1048 T1190 | Mapped |
| CVE-2022-28810 | Zoho ManageEngine | T1190 | Mapped |
| CVE-2022-29303 | SolarView Compact | T1496 | Mapped |
| CVE-2022-29464 | WSO2 Multiple Products | T1190 T1496 | Mapped |
| CVE-2022-35914 | Teclib GLPI | T1190 | Mapped |
| CVE-2022-36804 | Atlassian Bitbucket Server and Data Center | T1190 | Mapped |
| CVE-2022-39197 | Fortra Cobalt Strike | T1190 | Mapped |
| CVE-2022-40684 | Fortinet Multiple Products | T1190 | Mapped |
| CVE-2022-42475 | Fortinet FortiOS | T1190 | Mapped |
| CVE-2022-42948 | Fortra Cobalt Strike | T1190 | Mapped |
| CVE-2022-43939 | Hitachi Vantara Pentaho Business Analytics (BA) Server | T1190 | Mapped |
| CVE-2022-47966 | Zoho ManageEngine | T1190 | Mapped |
| CVE-2023-0669 | Fortra GoAnywhere MFT | T1190 | Mapped |
| CVE-2023-1389 | TP-Link Archer AX21 | T1496 | Mapped |
| CVE-2023-20198 | Cisco IOS XE Web UI | T1190 | Mapped |
| CVE-2023-20887 | VMware Aria Operations for Networks | T1190 | Mapped |
| CVE-2023-22515 | Atlassian Confluence Data Center and Server | T1190 | Mapped |
| CVE-2023-22518 | Atlassian Confluence Data Center and Server | T1190 | Mapped |
| CVE-2023-22527 | Atlassian Confluence Data Center and Server | T1496 | Mapped |
| CVE-2023-22952 | SugarCRM Multiple Products | T1190 T1530 | Stale |
| CVE-2023-26359 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2023-26360 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2023-27350 | PaperCut MF/NG | T1190 | Mapped |
| CVE-2023-27524 | Apache Superset | T1190 | Mapped |
| CVE-2023-27997 | Fortinet FortiOS and FortiProxy SSL-VPN | T1190 | Mapped |
| CVE-2023-28252 | Microsoft Windows | T1021 | Mapped |
| CVE-2023-29298 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2023-29300 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2023-29492 | Novi Survey Novi Survey | T1190 | Mapped |
| CVE-2023-32315 | Ignite Realtime Openfire | T1496 | Mapped |
| CVE-2023-33246 | Apache RocketMQ | T1190 | Mapped |
| CVE-2023-34362 | Progress MOVEit Transfer | T1190 | Mapped |
| CVE-2023-35078 | Ivanti Endpoint Manager Mobile (EPMM) | T1190 | Mapped |
| CVE-2023-35081 | Ivanti Endpoint Manager Mobile (EPMM) | T1190 | Mapped |
| CVE-2023-3519 | Citrix NetScaler ADC and NetScaler Gateway | T1190 | Mapped |
| CVE-2023-36844 | Juniper Junos OS | T1190 | Mapped |
| CVE-2023-36845 | Juniper Junos OS | T1190 | Mapped |
| CVE-2023-36846 | Juniper Junos OS | T1190 | Mapped |
| CVE-2023-36847 | Juniper Junos OS | T1190 | Mapped |
| CVE-2023-36851 | Juniper Junos OS | T1190 | Mapped |
| CVE-2023-38035 | Ivanti Sentry | T1190 T1496 | Mapped |
| CVE-2023-38203 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2023-38205 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2023-38950 | ZKTeco BioTime | T1190 | Mapped |
| CVE-2023-42793 | JetBrains TeamCity | T1190 | Mapped |
| CVE-2023-44487 | IETF HTTP/2 | T1190 | Mapped |
| CVE-2023-46604 | Apache ActiveMQ | T1190 | Mapped |
| CVE-2023-46805 | Ivanti Connect Secure and Policy Secure | T1190 | Mapped |
| CVE-2023-47565 | QNAP VioStor NVR | T1496 | Mapped |
| CVE-2023-48365 | Qlik Sense | T1190 | Mapped |
| CVE-2023-48788 | Fortinet FortiClient EMS | T1190 | Mapped |
| CVE-2023-49103 | ownCloud ownCloud graphapi | T1190 | Mapped |
| CVE-2023-49897 | FXC AE1021, AE1021PE | T1496 | Mapped |
| CVE-2023-7101 | Spreadsheet::ParseExcel Spreadsheet::ParseExcel | T1190 | Mapped |
| CVE-2024-0769 | D-Link DIR-859 Router | T1190 | Mapped |
| CVE-2024-13159 | Ivanti Endpoint Manager (EPM) | T1190 | Mapped |
| CVE-2024-13160 | Ivanti Endpoint Manager (EPM) | T1190 | Mapped |
| CVE-2024-13161 | Ivanti Endpoint Manager (EPM) | T1190 | Mapped |
| CVE-2024-20353 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | T1190 | Mapped |
| CVE-2024-20953 | Oracle Agile Product Lifecycle Management (PLM) | T1190 | Mapped |
| CVE-2024-21762 | Fortinet FortiOS | T1190 | Mapped |
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure | T1190 | Mapped |
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons | T1190 | Mapped |
| CVE-2024-23692 | Rejetto HTTP File Server | T1496 | Mapped |
| CVE-2024-27198 | JetBrains TeamCity | T1190 | Mapped |
| CVE-2024-34102 | Adobe Commerce and Magento Open Source | T1190 | Mapped |
| CVE-2024-38475 | Apache HTTP Server | T1190 | Mapped |
| CVE-2024-4358 | Progress Telerik Report Server | T1190 | Mapped |
| CVE-2024-45195 | Apache OFBiz | T1498.001 | Mapped |
| CVE-2024-4577 | PHP Group PHP | T1190 | Mapped |
| CVE-2024-48248 | NAKIVO Backup and Replication | T1190 | Mapped |
| CVE-2024-4879 | ServiceNow Utah, Vancouver, and Washington DC Now Platform | T1190 | Mapped |
| CVE-2024-49035 | Microsoft Partner Center | T1530 | Mapped |
| CVE-2024-55550 | Mitel MiCollab | T1190 | Mapped |
| CVE-2024-55591 | Fortinet FortiOS and FortiProxy | T1021 | Mapped |
| CVE-2024-57727 | SimpleHelp SimpleHelp | T1190 | Mapped |
| CVE-2025-0108 | Palo Alto Networks PAN-OS | T1190 | Mapped |
| CVE-2025-0282 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways | T1190 | Mapped |
| CVE-2025-1316 | Edimax IC-7100 IP Camera | T1190 | Mapped |
| CVE-2025-22457 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways | T1190 | Mapped |
| CVE-2025-23006 | SonicWall SMA1000 Appliances | T1190 | Mapped |
| CVE-2025-25257 | Fortinet FortiWeb | T1190 | Mapped |
| CVE-2025-27363 | FreeType FreeType | T1499.004 | Mapped |
| CVE-2025-34028 | Commvault Command Center | T1190 | Mapped |
| CVE-2025-35939 | Craft CMS Craft CMS | T1190 | Mapped |
| CVE-2025-42599 | Qualitia Active! Mail | T1190 | Mapped |
| CVE-2025-42999 | SAP NetWeaver | T1190 | Mapped |
| CVE-2025-4427 | Ivanti Endpoint Manager Mobile (EPMM) | T1190 | Mapped |
| CVE-2025-4428 | Ivanti Endpoint Manager Mobile (EPMM) | T1190 | Mapped |
| CVE-2025-4632 | Samsung MagicINFO 9 Server | T1496 | Mapped |
| CVE-2025-49704 | Microsoft SharePoint | T1190 | Mapped |
| CVE-2025-49706 | Microsoft SharePoint | T1190 | Mapped |
| CVE-2025-53770 | Microsoft SharePoint | T1190 | Mapped |
| CVE-2025-54309 | CrushFTP CrushFTP | T1021 | Mapped |
| CVE-2025-5777 | Citrix NetScaler ADC and Gateway | T1190 | Mapped |