kevmap

Log sources › Internet Scan

Internet Scan

Inverted view: what can be detected if this is the log you have. PRE

1
channels
27
analytics
27
techniques
14
KEV CVEs reachable

"Reachable" means: a KEV CVE has a public mapping to a technique, and MITRE's analytic for that technique names this log source. It is a statement about published knowledge, not about whether any particular rule fires.

Channels

ChannelData componentsAnalyticsTechniques
None DC0104 Response Content
DC0106 Response Metadata		 AN1952 AN1956 AN1957 AN1958 AN1961 AN1966 AN1968 AN1970 AN1971 AN1972 AN1976 AN1980 AN1982 AN1985 AN1986 AN1991 AN1996 AN2003 AN2006 AN2013 AN2014 AN2017 AN2019 AN2020 AN2025 AN2027 AN2028 27

Techniques detectable from this source

TechniqueTacticsSigma rulesKEV CVEs
T1583 Acquire Infrastructureresource development00
T1583.003 Virtual Private Serverresource development00
T1583.004 Serverresource development00
T1583.006 Web Servicesresource development00
T1583.007 Serverlessresource development00
T1583.008 Malvertisingresource development00
T1584 Compromise Infrastructureresource development40
T1584.003 Virtual Private Serverresource development00
T1584.004 Serverresource development00
T1584.006 Web Servicesresource development00
T1584.007 Serverlessresource development00
T1584.008 Network Devicesresource development00
T1587 Develop Capabilitiesresource development60
T1587.003 Digital Certificatesresource development00
T1588 Obtain Capabilitiesresource development21
T1588.004 Digital Certificatesresource development00
T1592 Gather Victim Host Informationreconnaissance02
T1592.001 Hardwarereconnaissance00
T1592.002 Softwarereconnaissance00
T1592.004 Client Configurationsreconnaissance30
T1608 Stage Capabilitiesresource development20
T1608.001 Upload Malwareresource development011
T1608.002 Upload Toolresource development00
T1608.003 Install Digital Certificateresource development10
T1608.004 Drive-by Targetresource development00
T1608.005 Link Targetresource development00
T1608.006 SEO Poisoningresource development00

KEV CVEs reachable from this source

CVEVendor / productVia techniqueState
CVE-2013-0631Adobe ColdFusion T1592 Mapped
CVE-2017-12637SAP NetWeaver T1592 Mapped
CVE-2019-0604Microsoft SharePoint T1608.001 Mapped
CVE-2021-44228Apache Log4j2 T1608.001 Mapped
CVE-2023-33246Apache RocketMQ T1608.001 Mapped
CVE-2023-39780ASUS RT-AX55 Routers T1588 Mapped
CVE-2024-20353Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) T1608.001 Mapped
CVE-2024-37085VMware ESXi T1608.001 Mapped
CVE-2024-54085AMI MegaRAC SPx T1608.001 Mapped
CVE-2025-32701Microsoft Windows T1608.001 Mapped
CVE-2025-32706Microsoft Windows T1608.001 Mapped
CVE-2025-32709Microsoft Windows T1608.001 Mapped
CVE-2025-32756Fortinet Multiple Products T1608.001 Mapped
CVE-2025-4632Samsung MagicINFO 9 Server T1608.001 Mapped