Log sources › WinEventLog:Security

WinEventLog:Security

Inverted view: what can be detected if this is the log you have. Identity Provider, Office Suite, Windows

channels

284

analytics

280

techniques

270

KEV CVEs reachable

"Reachable" means: a KEV CVE has a public mapping to a technique, and MITRE's analytic for that technique names this log source. It is a statement about published knowledge, not about whether any particular rule fires.

Channels

Channel	Data components	Analytics	Techniques
`ARP cache modification attempts observed through event tracing or security baselines`	DC0078 Network Traffic Flow	AN1091	1
`Anomalous logon without MFA enforcement`	DC0067 Logon Session Creation	AN0814	1
`Device Object Creation`	DC0087 Active Directory Object Creation	AN0104	1
`EventCode=1`	DC0032 Process Creation	AN1331	1
`EventCode=1074`	DC0018 Host Status	AN1538	1
`EventCode=1102`	DC0038 Application Log Content	AN0520 AN0535 AN1472	3
`EventCode=1166, 7045`	DC0018 Host Status	AN1035	1
`EventCode=3033`	DC0016 Module Load	AN0629	1
`EventCode=4103, 4104, 4105, 4106`	DC0064 Command Execution	AN0151	1
`EventCode=4624`	DC0067 Logon Session Creation	AN1543	1
`EventCode=4624, 4625, 4768, 4769`	DC0088 Logon Session Metadata	AN0590	1
`EventCode=4624, 4648`	DC0067 Logon Session Creation	AN0147 AN0199 AN0216 AN0286 AN0420 AN0444 AN0484 AN0498 AN0504 AN0687 AN0719 AN0750 AN0757 AN0791 AN0792 AN0856 AN0931 AN0954 AN1000 AN1108 AN1137 AN1144 AN1283 AN1305 AN1313 AN1344 AN1361 AN1398 AN1468 AN1551 AN1620 AN2035	32
`EventCode=4625`	DC0002 User Account Authentication	AN0147 AN0451 AN1262 AN1521	4
`EventCode=4625, 4771, 4648`	DC0002 User Account Authentication	AN1336	1
`EventCode=4648`	DC0002 User Account Authentication	AN1551	1
`EventCode=4657`	DC0050 Windows Registry Key Access DC0063 Windows Registry Key Modification	AN0009 AN0024 AN0051 AN0113 AN0153 AN0176 AN0287 AN0311 AN0577 AN0583 AN0595 AN0609 AN0667 AN0671 AN0909 AN0973 AN0995 AN1029 AN1097 AN1186 AN1195 AN1222 AN1246 AN1303 AN1319 AN1323 AN1446 AN1495 AN1561 AN1588 AN1598	30
`EventCode=4661`	DC0071 Active Directory Object Access	AN0152	1
`EventCode=4662`	DC0071 Active Directory Object Access	AN0016 AN0455 AN0648 AN0770 AN1632	5
`EventCode=4663, 4656, 4658`	DC0059 File Metadata	AN1177	1
`EventCode=4663, 4670, 4656`	DC0021 OS API Execution DC0035 Process Access DC0038 Application Log Content DC0050 Windows Registry Key Access DC0055 File Access DC0059 File Metadata DC0061 File Modification DC0063 Windows Registry Key Modification DC0066 Active Directory Object Modification	AN0040 AN0065 AN0105 AN0130 AN0133 AN0139 AN0162 AN0184 AN0199 AN0229 AN0243 AN0282 AN0292 AN0331 AN0342 AN0392 AN0423 AN0436 AN0469 AN0555 AN0568 AN0616 AN0628 AN0648 AN0662 AN0705 AN0712 AN0724 AN0737 AN0755 AN0787 AN0823 AN0834 AN0854 AN0895 AN0988 AN1177 AN1198 AN1212 AN1271 AN1344 AN1357 AN1393 AN1410 AN1413 AN1417 AN1528 AN1571 AN1622 AN1626 AN2030	51
`EventCode=4672`	DC0088 Logon Session Metadata	AN0061 AN0147 AN0170 AN0444 AN0871 AN0975 AN1094 AN1137 AN1375 AN1398 AN1419	11
`EventCode=4672, 4634`	DC0088 Logon Session Metadata	AN0405 AN0675 AN0786 AN1253 AN1443	5
`EventCode=4673`	DC0013 User Account Metadata	AN0384 AN0827 AN0882 AN1030 AN1398	5
`EventCode=4688`	DC0032 Process Creation	AN0045 AN0048 AN0052 AN0095 AN0119 AN0123 AN0126 AN0178 AN0199 AN0235 AN0237 AN0240 AN0251 AN0274 AN0275 AN0298 AN0311 AN0317 AN0320 AN0323 AN0345 AN0367 AN0378 AN0406 AN0430 AN0441 AN0445 AN0474 AN0488 AN0498 AN0507 AN0513 AN0550 AN0574 AN0578 AN0608 AN0614 AN0619 AN0623 AN0643 AN0677 AN0705 AN0747 AN0764 AN0774 AN0785 AN0831 AN0834 AN0871 AN0875 AN0886 AN0927 AN0949 AN0962 AN0969 AN0975 AN0983 AN0992 AN1025 AN1028 AN1034 AN1040 AN1052 AN1064 AN1070 AN1094 AN1100 AN1113 AN1153 AN1174 AN1177 AN1178 AN1193 AN1207 AN1213 AN1253 AN1314 AN1324 AN1325 AN1335 AN1351 AN1353 AN1375 AN1394 AN1397 AN1402 AN1433 AN1446 AN1452 AN1458 AN1511 AN1528 AN1535 AN1548 AN1551 AN1567 AN1589 AN1595 AN1610 AN1611 AN1612 AN1633 AN1641 AN2030 AN2038 AN2043 AN2063	106
`EventCode=4697`	DC0060 Service Creation	AN0778 AN1185 AN1274 AN1527 AN1575	5
`EventCode=4698`	DC0001 Scheduled Job Creation	AN0024 AN0258 AN0324 AN0943 AN1221 AN1489 AN1507	7
`EventCode=4702`	DC0012 Scheduled Job Modification	AN1221	1
`EventCode=4704`	DC0010 User Account Modification	AN0854 AN1259	2
`EventCode=4720`	DC0014 User Account Creation	AN0006 AN1001 AN1077 AN1235 AN1604	5
`EventCode=4720, 4738`	DC0013 User Account Metadata	AN0383	1
`EventCode=4723, 4724, 4740`	DC0010 User Account Modification	AN0334	1
`EventCode=4726, 4657`	DC0009 User Account Deletion	AN0113	1
`EventCode=4728, 4729, 4732, 4733, 4756, 4757`	DC0010 User Account Modification	AN0865	1
`EventCode=4738, 4728, 4670`	DC0010 User Account Modification	AN0265	1
`EventCode=4739`	DC0066 Active Directory Object Modification	AN0543 AN1621	2
`EventCode=4768`	DC0084 Active Directory Credential Request	AN0316 AN0671 AN1000 AN1144	4
`EventCode=4768, 4769, 4770`	DC0002 User Account Authentication	AN0493	1
`EventCode=4769`	DC0002 User Account Authentication DC0084 Active Directory Credential Request	AN0405 AN0444 AN1000	3
`EventCode=4769, 1200, 1202`	DC0002 User Account Authentication	AN0418	1
`EventCode=4776, 4625`	DC0002 User Account Authentication	AN1004 AN1275 AN1476 AN1543	4
`EventCode=4776, 4771, 4770`	DC0088 Logon Session Metadata	AN1344	1
`EventCode=4778, EventCode=4779`	DC0088 Logon Session Metadata	AN0931	1
`EventCode=4798, 4799`	DC0099 Group Enumeration	AN1612	1
`EventCode=4800, 4801`	DC0088 Logon Session Metadata	AN1182	1
`EventCode=4928`	DC0087 Active Directory Object Creation	AN0770	1
`EventCode=4929`	DC0068 Active Directory Object Deletion DC0084 Active Directory Credential Request	AN0770 AN1632	2
`EventCode=5136`	DC0066 Active Directory Object Modification	AN0383 AN0755 AN0786 AN0814 AN0854 AN1253 AN1259	7
`EventCode=5140`	DC0102 Network Share Access	AN0516	1
`EventCode=5145`	DC0102 Network Share Access	AN1034 AN1075 AN1145 AN1160 AN1298 AN1309 AN1516	7
`EventCode=5156, 5157`	DC0082 Network Connection Creation	AN0633 AN1015 AN1148 AN2043	4
`EventCode=6416`	DC0038 Application Log Content	AN0185	1
`Firewall Rule Modification`	DC0051 Firewall Rule Modification	AN0133	1
`Registry key modification HKLM\Software\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast`	DC0063 Windows Registry Key Modification	AN1274	1
`modification to Winlogon registry keys such as Shell, Notify, or Userinit`	DC0063 Windows Registry Key Modification	AN1133	1

Techniques detectable from this source

Technique	Tactics	Sigma rules	KEV CVEs
T1003 OS Credential Dumping	credential access	37	18
T1003.001 LSASS Memory	credential access	79	4
T1003.002 Security Account Manager	credential access	28	0
T1003.003 NTDS	credential access	24	3
T1003.004 LSA Secrets	credential access	12	0
T1003.005 Cached Domain Credentials	credential access	8	0
T1003.006 DCSync	credential access	7	0
T1005 Data from Local System	collection	14	46
T1006 Direct Volume Access	stealth	1	0
T1007 System Service Discovery	discovery	11	1
T1016.001 Internet Connection Discovery	discovery	0	0
T1020 Automated Exfiltration	exfiltration	10	0
T1021 Remote Services	lateral movement	11	4
T1021.001 Remote Desktop Protocol	lateral movement	16	2
T1021.002 SMB/Windows Admin Shares	lateral movement	38	0
T1021.003 Distributed Component Object Model	lateral movement	13	0
T1021.005 VNC	lateral movement	1	0
T1021.006 Windows Remote Management	lateral movement	11	0
T1025 Data from Removable Media	collection	0	0
T1027 Obfuscated Files or Information	stealth	94	5
T1027.001 Binary Padding	stealth	3	0
T1027.003 Steganography	stealth	5	0
T1027.010 Command Obfuscation	stealth	10	0
T1027.011 Fileless Storage	stealth	1	0
T1027.013 Encrypted/Encoded File	stealth	0	0
T1027.018 Invisible Unicode	stealth	0	0
T1036.004 Masquerade Task or Service	stealth	3	0
T1036.005 Match Legitimate Resource Name or Location	stealth	21	1
T1036.010 Masquerade Account Name	stealth	0	0
T1037 Boot or Logon Initialization Scripts	persistence, privilege escalation	0	3
T1037.001 Logon Script (Windows)	persistence, privilege escalation	3	0
T1037.003 Network Logon Script	persistence, privilege escalation	0	0
T1039 Data from Network Shared Drive	collection	2	0
T1040 Network Sniffing	credential access, discovery	9	2
T1041 Exfiltration Over C2 Channel	exfiltration	5	12
T1048 Exfiltration Over Alternative Protocol	exfiltration	12	4
T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	exfiltration	0	0
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol	exfiltration	9	1
T1052 Exfiltration Over Physical Medium	exfiltration	0	0
T1052.001 Exfiltration over USB	exfiltration	0	0
T1053 Scheduled Task/Job	execution, persistence, privilege escalation	12	2
T1053.002 At	execution, persistence, privilege escalation	8	0
T1053.005 Scheduled Task	execution, persistence, privilege escalation	51	2
T1055.011 Extra Window Memory Injection	stealth, privilege escalation	1	0
T1056 Input Capture	collection, credential access	2	3
T1056.001 Keylogging	collection, credential access	3	1
T1057 Process Discovery	discovery	8	0
T1059.003 Windows Command Shell	execution	46	6
T1068 Exploitation for Privilege Escalation	privilege escalation	31	69
T1069 Permission Groups Discovery	discovery	3	1
T1069.001 Local Groups	discovery	16	0
T1069.002 Domain Groups	discovery	15	0
T1070 Indicator Removal	stealth	20	3
T1070.003 Clear Command History	stealth	9	0
T1070.004 File Deletion	stealth	15	5
T1070.005 Network Share Connection Removal	stealth	4	0
T1070.006 Timestomp	stealth	6	0
T1070.007 Clear Network Connection History and Configurations	stealth	0	0
T1070.008 Clear Mailbox Data	stealth	2	0
T1070.009 Clear Persistence	stealth	0	0
T1072 Software Deployment Tools	execution, lateral movement	4	0
T1074 Data Staged	collection	2	0
T1074.001 Local Data Staging	collection	4	0
T1078 Valid Accounts	stealth, persistence, privilege escalation, initial access	56	46
T1078.001 Default Accounts	stealth, persistence, privilege escalation, initial access	4	0
T1078.002 Domain Accounts	stealth, persistence, privilege escalation, initial access	7	0
T1078.003 Local Accounts	stealth, persistence, privilege escalation, initial access	5	1
T1080 Taint Shared Content	lateral movement	0	0
T1082 System Information Discovery	discovery	33	7
T1083 File and Directory Discovery	discovery	24	5
T1087 Account Discovery	discovery	16	6
T1098 Account Manipulation	persistence, privilege escalation	34	2
T1098.002 Additional Email Delegate Permissions	persistence, privilege escalation	0	0
T1098.005 Device Registration	persistence, privilege escalation	1	0
T1098.007 Additional Local or Domain Groups	persistence, privilege escalation	0	0
T1110 Brute Force	credential access	25	2
T1110.001 Password Guessing	credential access	3	0
T1110.002 Password Cracking	credential access	1	0
T1110.003 Password Spraying	credential access	0	0
T1110.004 Credential Stuffing	credential access	0	0
T1111 Multi-Factor Authentication Interception	credential access	0	0
T1114 Email Collection	collection	4	3
T1114.001 Local Email Collection	collection	1	0
T1114.003 Email Forwarding Rule	collection	6	0
T1120 Peripheral Device Discovery	discovery	2	0
T1123 Audio Capture	collection	6	0
T1124 System Time Discovery	discovery	3	0
T1125 Video Capture	collection	1	0
T1127 Trusted Developer Utilities Proxy Execution	stealth, execution	20	0
T1127.001 MSBuild	stealth, execution	1	0
T1127.002 ClickOnce	stealth, execution	0	0
T1127.003 JamPlus	stealth, execution	0	0
T1129 Shared Modules	execution	2	0
T1132.001 Standard Encoding	command and control	4	0
T1132.002 Non-Standard Encoding	command and control	0	0
T1133 External Remote Services	persistence, initial access	20	25
T1134 Access Token Manipulation	stealth, privilege escalation	4	0
T1134.001 Token Impersonation/Theft	stealth, privilege escalation	9	1
T1134.002 Create Process with Token	stealth, privilege escalation	7	0
T1134.003 Make and Impersonate Token	stealth, privilege escalation	4	0
T1134.004 Parent PID Spoofing	stealth, privilege escalation	1	0
T1134.005 SID-History Injection	stealth, privilege escalation	1	0
T1135 Network Share Discovery	discovery	7	0
T1136 Create Account	persistence	3	10
T1136.001 Local Account	persistence	18	2
T1136.002 Domain Account	persistence	6	0
T1176 Software Extensions	persistence	1	0
T1176.001 Browser Extensions	persistence	2	0
T1176.002 IDE Extensions	persistence	0	0
T1185 Browser Session Hijacking	collection	2	3
T1187 Forced Authentication	credential access	9	0
T1189 Drive-by Compromise	initial access	3	21
T1195.003 Compromise Hardware Supply Chain	initial access	0	0
T1197 BITS Jobs	stealth, persistence, execution	16	0
T1199 Trusted Relationship	initial access	2	1
T1200 Hardware Additions	initial access	3	0
T1201 Password Policy Discovery	discovery	6	0
T1204 User Execution	execution	10	2
T1204.001 Malicious Link	execution	4	11
T1204.004 Malicious Copy and Paste	execution	6	0
T1207 Rogue Domain Controller	defense impairment	2	0
T1211 Exploitation for Stealth	stealth	4	1
T1212 Exploitation for Credential Access	credential access	5	4
T1213 Data from Information Repositories	collection	7	2
T1213.006 Databases	collection	0	0
T1218.005 Mshta	stealth	8	0
T1218.007 Msiexec	stealth	10	0
T1218.008 Odbcconf	stealth	8	0
T1218.009 Regsvcs/Regasm	stealth	4	0
T1218.010 Regsvr32	stealth	19	0
T1218.013 Mavinject	stealth	2	0
T1222 File and Directory Permissions Modification	defense impairment	2	1
T1222.001 Windows Permissions	defense impairment	5	0
T1480 Execution Guardrails	stealth	0	0
T1480.001 Environmental Keying	stealth	0	0
T1482 Domain Trust Discovery	discovery	17	2
T1484 Domain or Tenant Policy Modification	defense impairment, privilege escalation	1	0
T1484.001 Group Policy Modification	defense impairment, privilege escalation	6	1
T1484.002 Trust Modification	defense impairment, privilege escalation	2	0
T1489 Service Stop	impact	20	1
T1491 Defacement	impact	0	0
T1491.001 Internal Defacement	impact	4	0
T1491.002 External Defacement	impact	0	1
T1495 Firmware Corruption	impact	1	2
T1496.001 Compute Hijacking	impact	0	0
T1497.002 User Activity Based Checks	stealth, discovery	0	0
T1498.001 Direct Network Flood	impact	0	1
T1505 Server Software Component	persistence	1	2
T1505.003 Web Shell	persistence	35	26
T1505.004 IIS Components	persistence	5	0
T1505.005 Terminal Services DLL	persistence	1	0
T1518 Software Discovery	discovery	4	0
T1518.001 Security Software Discovery	discovery	9	0
T1518.002 Backup Software Discovery	discovery	0	0
T1529 System Shutdown/Reboot	impact	8	0
T1531 Account Access Removal	impact	9	1
T1534 Internal Spearphishing	lateral movement	0	0
T1539 Steal Web Session Cookie	credential access	2	0
T1542 Pre-OS Boot	stealth, persistence	0	0
T1542.001 System Firmware	stealth, persistence	2	0
T1543 Create or Modify System Process	persistence, privilege escalation	9	9
T1543.003 Windows Service	persistence, privilege escalation	47	0
T1546 Event Triggered Execution	privilege escalation, persistence	10	0
T1546.001 Change Default File Association	privilege escalation, persistence	5	0
T1546.002 Screensaver	privilege escalation, persistence	4	0
T1546.007 Netsh Helper DLL	privilege escalation, persistence	4	0
T1546.009 AppCert DLLs	privilege escalation, persistence	2	0
T1546.011 Application Shimming	privilege escalation, persistence	6	0
T1546.012 Image File Execution Options Injection	privilege escalation, persistence	2	0
T1546.015 Component Object Model Hijacking	privilege escalation, persistence	9	0
T1547 Boot or Logon Autostart Execution	persistence, privilege escalation	7	1
T1547.002 Authentication Package	persistence, privilege escalation	1	0
T1547.004 Winlogon Helper DLL	persistence, privilege escalation	4	0
T1547.005 Security Support Provider	persistence, privilege escalation	1	0
T1547.008 LSASS Driver	persistence, privilege escalation	1	0
T1547.014 Active Setup	persistence, privilege escalation	1	0
T1548 Abuse Elevation Control Mechanism	privilege escalation	24	4
T1548.002 Bypass User Account Control	privilege escalation	56	1
T1550 Use Alternate Authentication Material	lateral movement	5	0
T1550.002 Pass the Hash	lateral movement	6	4
T1550.003 Pass the Ticket	lateral movement	7	0
T1552 Unsecured Credentials	credential access	13	4
T1552.001 Credentials In Files	credential access	24	3
T1552.004 Private Keys	credential access	7	1
T1552.006 Group Policy Preferences	credential access	6	0
T1553 Subvert Trust Controls	defense impairment	4	0
T1553.002 Code Signing	defense impairment	1	0
T1553.003 SIP and Trust Provider Hijacking	defense impairment	2	0
T1553.004 Install Root Certificate	defense impairment	10	0
T1553.005 Mark-of-the-Web Bypass	defense impairment	6	2
T1553.006 Code Signing Policy Modification	defense impairment	0	0
T1554 Compromise Host Software Binary	persistence	6	0
T1555 Credentials from Password Stores	credential access	8	9
T1555.003 Credentials from Web Browsers	credential access	8	0
T1555.004 Windows Credential Manager	credential access	4	0
T1555.005 Password Managers	credential access	1	0
T1556 Modify Authentication Process	defense impairment, persistence, credential access	12	2
T1556.001 Domain Controller Authentication	defense impairment, persistence, credential access	0	0
T1556.002 Password Filter DLL	defense impairment, persistence, credential access	3	0
T1556.005 Reversible Encryption	defense impairment, persistence, credential access	0	0
T1556.006 Multi-Factor Authentication	defense impairment, persistence, credential access	3	0
T1556.007 Hybrid Identity	defense impairment, persistence, credential access	0	0
T1556.008 Network Provider DLL	defense impairment, persistence, credential access	0	0
T1557 Adversary-in-the-Middle	credential access, collection	10	4
T1557.001 Name Resolution Poisoning and SMB Relay	credential access, collection	10	1
T1557.002 ARP Cache Poisoning	credential access, collection	0	0
T1558 Steal or Forge Kerberos Tickets	credential access	6	3
T1558.001 Golden Ticket	credential access	1	0
T1558.002 Silver Ticket	credential access	1	0
T1558.003 Kerberoasting	credential access	18	0
T1558.004 AS-REP Roasting	credential access	0	0
T1559 Inter-Process Communication	execution	1	0
T1559.001 Component Object Model	execution	4	0
T1559.002 Dynamic Data Exchange	execution	1	0
T1560 Archive Collected Data	collection	4	0
T1560.001 Archive via Utility	collection	17	2
T1560.002 Archive via Library	collection	0	0
T1560.003 Archive via Custom Method	collection	0	0
T1561 Disk Wipe	impact	0	0
T1561.001 Disk Content Wipe	impact	1	0
T1561.002 Disk Structure Wipe	impact	1	0
T1563 Remote Service Session Hijacking	lateral movement	0	0
T1563.002 RDP Hijacking	lateral movement	2	0
T1564.002 Hidden Users	stealth	4	0
T1564.005 Hidden File System	stealth	0	0
T1564.006 Run Virtual Instance	stealth	2	0
T1564.010 Process Argument Spoofing	stealth	0	0
T1564.012 File/Path Exclusions	stealth	0	0
T1565 Data Manipulation	impact	3	2
T1565.001 Stored Data Manipulation	impact	6	2
T1565.003 Runtime Data Manipulation	impact	0	0
T1566.002 Spearphishing Link	initial access	4	5
T1566.003 Spearphishing via Service	initial access	0	0
T1567 Exfiltration Over Web Service	exfiltration	12	3
T1567.001 Exfiltration to Code Repository	exfiltration	2	0
T1567.002 Exfiltration to Cloud Storage	exfiltration	14	0
T1567.003 Exfiltration to Text Storage Sites	exfiltration	0	0
T1567.004 Exfiltration Over Webhook	exfiltration	0	0
T1568.001 Fast Flux DNS	command and control	0	0
T1568.002 Domain Generation Algorithms	command and control	2	0
T1569 System Services	execution	4	0
T1569.002 Service Execution	execution	43	1
T1570 Lateral Tool Transfer	lateral movement	6	1
T1571 Non-Standard Port	command and control	5	1
T1574 Hijack Execution Flow	stealth, execution	8	16
T1574.001 DLL	stealth, execution	93	0
T1574.007 Path Interception by PATH Environment Variable	stealth, execution	2	0
T1574.009 Path Interception by Unquoted Path	stealth, execution	0	0
T1574.011 Services Registry Permissions Weakness	stealth, execution	11	0
T1574.012 COR_PROFILER	stealth, execution	2	0
T1574.014 AppDomainManager	stealth, execution	0	0
T1606 Forge Web Credentials	credential access	1	0
T1606.001 Web Cookies	credential access	0	0
T1606.002 SAML Tokens	credential access	0	0
T1611 Escape to Host	privilege escalation	2	3
T1614 System Location Discovery	discovery	0	0
T1614.001 System Language Discovery	discovery	2	0
T1615 Group Policy Discovery	discovery	5	0
T1621 Multi-Factor Authentication Request Generation	credential access	2	0
T1649 Steal or Forge Authentication Certificates	credential access	11	0
T1652 Device Driver Discovery	discovery	0	0
T1653 Power Settings	persistence	1	1
T1654 Log Enumeration	discovery	0	0
T1657 Financial Theft	impact	0	0
T1659 Content Injection	initial access, command and control	0	0
T1665 Hide Infrastructure	command and control	0	0
T1668 Exclusive Control	persistence	0	0
T1669 Wi-Fi Networks	initial access	0	0
T1673 Virtual Machine Discovery	discovery	0	0
T1674 Input Injection	execution	0	0
T1679 Selective Exclusion	stealth	0	0
T1684 Social Engineering	stealth	0	0
T1684.001 Impersonation	stealth	0	0
T1685.001 Disable or Modify Windows Event Log	defense impairment	28	0
T1685.005 Clear Windows Event Logs	defense impairment	8	0
T1686 Disable or Modify System Firewall	defense impairment	7	0
T1686.003 Windows Host Firewall	defense impairment	20	0
T1687 Exploitation for Defense Impairment	defense impairment	0	0
T1688 Safe Mode Boot	defense impairment	0	0
T1689 Downgrade Attack	defense impairment	1	0

KEV CVEs reachable from this source

CVE	Vendor / product	Via technique	State
CVE-2010-0188	Adobe Reader and Acrobat	T1189	Mapped
CVE-2010-1297	Adobe Flash Player	T1189	Mapped
CVE-2010-2883	Adobe Acrobat and Reader	T1027	Mapped
CVE-2012-0767	Adobe Flash Player	T1098 T1185 T1204.001	Mapped
CVE-2012-2034	Adobe Flash Player	T1189	Mapped
CVE-2012-5054	Adobe Flash Player	T1189	Mapped
CVE-2013-0629	Adobe ColdFusion	T1005	Mapped
CVE-2013-0641	Adobe Reader	T1048	Mapped
CVE-2014-0546	Adobe Reader and Acrobat	T1068	Mapped
CVE-2014-6271	GNU Bourne-Again Shell (Bash)	T1133	Mapped
CVE-2014-7169	GNU Bourne-Again Shell (Bash)	T1133	Mapped
CVE-2014-8439	Adobe Flash Player	T1189	Mapped
CVE-2015-0310	Adobe Flash Player	T1189	Mapped
CVE-2015-0313	Adobe Flash Player	T1189	Mapped
CVE-2015-3043	Adobe Flash Player	T1189	Mapped
CVE-2015-5119	Adobe Flash Player	T1204.001 T1566.002	Mapped
CVE-2015-8651	Adobe Flash Player	T1189	Mapped
CVE-2016-1010	Adobe Flash Player and AIR	T1574	Mapped
CVE-2016-1019	Adobe Flash Player	T1189	Mapped
CVE-2016-7855	Adobe Flash Player	T1189	Mapped
CVE-2017-11292	Adobe Flash Player	T1005	Mapped
CVE-2017-12637	SAP NetWeaver	T1083 T1555	Mapped
CVE-2017-5638	Apache Struts	T1005	Mapped
CVE-2017-6742	Cisco IOS and IOS XE Software	T1048 T1574	Mapped
CVE-2018-0296	Cisco Adaptive Security Appliance (ASA)	T1005	Mapped
CVE-2018-15961	Adobe ColdFusion	T1491.002	Mapped
CVE-2018-4878	Adobe Flash Player	T1041	Mapped
CVE-2018-4939	Adobe ColdFusion	T1133	Mapped
CVE-2019-0211	Apache HTTP Server	T1068	Mapped
CVE-2019-0604	Microsoft SharePoint	T1003 T1041 T1505.003	Mapped
CVE-2019-0708	Microsoft Remote Desktop Services	T1133	Mapped
CVE-2019-11510	Ivanti Pulse Connect Secure	T1083 T1133 T1552.001	Mapped
CVE-2019-11634	Citrix Workspace Application and Receiver for Windows	T1003 T1005 T1078	Mapped
CVE-2019-13608	Citrix StoreFront Server	T1003 T1005 T1078	Mapped
CVE-2019-1653	Cisco Small Business RV320 and RV325 Routers	T1005 T1007 T1082	Mapped
CVE-2019-18935	Progress Telerik UI for ASP.NET AJAX	T1041 T1505.003	Mapped
CVE-2019-19781	Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance	T1083 T1133	Mapped
CVE-2019-3396	Atlassian Confluence Server and Data Server	T1133	Mapped
CVE-2019-5591	Fortinet FortiOS	T1005 T1133 T1557	Mapped
CVE-2020-0069	MediaTek Multiple Chipsets	T1068	Mapped
CVE-2020-0688	Microsoft Exchange Server	T1110 T1114 T1505.003	Mapped
CVE-2020-0787	Microsoft Windows	T1068	Mapped
CVE-2020-12812	Fortinet FortiOS	T1556	Mapped
CVE-2020-1472	Microsoft Netlogon	T1021 T1068 T1110 T1133	Mapped
CVE-2020-25506	D-Link DNS-320 Device	T1133	Mapped
CVE-2020-3452	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)	T1005	Mapped
CVE-2020-3580	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)	T1204.001	Mapped
CVE-2020-5735	Amcrest Cameras and Network Video Recorder (NVR)	T1574	Mapped
CVE-2020-5902	F5 BIG-IP	T1003 T1005 T1070.004 T1133 T1552	Stale
CVE-2020-8193	Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance	T1005 T1556	Mapped
CVE-2020-8195	Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance	T1005 T1056 T1082	Mapped
CVE-2020-8196	Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance	T1005 T1056 T1082	Mapped
CVE-2020-8515	DrayTek Multiple Vigor Routers	T1133	Mapped
CVE-2021-1497	Cisco HyperFlex HX	T1133	Mapped
CVE-2021-1498	Cisco HyperFlex HX	T1133	Mapped
CVE-2021-20035	SonicWall SMA100 Appliances	T1078	Mapped
CVE-2021-22893	Ivanti Pulse Connect Secure	T1003	Mapped
CVE-2021-22894	Ivanti Pulse Connect Secure	T1078	Mapped
CVE-2021-22899	Ivanti Pulse Connect Secure	T1059.003 T1078	Mapped
CVE-2021-22900	Ivanti Pulse Connect Secure	T1068	Mapped
CVE-2021-22986	F5 BIG-IP and BIG-IQ Centralized Management	T1133	Mapped
CVE-2021-26085	Atlassian Confluence Server	T1005	Mapped
CVE-2021-26855	Microsoft Exchange Server	T1005 T1133 T1505.003	Mapped
CVE-2021-26857	Microsoft Exchange Server	T1133 T1505.003	Mapped
CVE-2021-26858	Microsoft Exchange Server	T1505.003	Mapped
CVE-2021-27065	Microsoft Exchange Server	T1505.003	Mapped
CVE-2021-27101	Accellion FTA	T1005	Mapped
CVE-2021-27102	Accellion FTA	T1005	Mapped
CVE-2021-27103	Accellion FTA	T1005	Mapped
CVE-2021-27104	Accellion FTA	T1005	Mapped
CVE-2021-27860	FatPipe WARP, IPVPN, and MPVPN software	T1505.003	Mapped
CVE-2021-29256	Arm Mali Graphics Processing Unit (GPU)	T1005 T1068	Mapped
CVE-2021-31207	Microsoft Exchange Server	T1548.002 T1565	Mapped
CVE-2021-32030	ASUS Routers	T1040 T1068 T1098	Mapped
CVE-2021-33739	Microsoft Windows	T1068	Mapped
CVE-2021-34473	Microsoft Exchange Server	T1048.003 T1053.005 T1136	Mapped
CVE-2021-35394	Realtek Jungle Software Development Kit (SDK)	T1569.002	Mapped
CVE-2021-36934	Microsoft Windows	T1068 T1078	Mapped
CVE-2021-4034	Red Hat Polkit	T1068	Mapped
CVE-2021-40449	Microsoft Windows	T1027 T1059.003 T1068 T1082	Mapped
CVE-2021-40539	Zoho ManageEngine	T1003 T1003.003 T1027 T1070.004 T1136 T1505.003 T1560.001	Mapped
CVE-2021-41379	Microsoft Windows	T1068 T1078	Mapped
CVE-2021-42321	Microsoft Exchange	T1078	Mapped
CVE-2021-44077	Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus	T1003 T1003.003 T1027 T1070.004 T1136 T1505.003 T1560.001	Mapped
CVE-2021-44168	Fortinet FortiOS	T1078.003	Mapped
CVE-2021-44228	Apache Log4j2	T1505.003	Mapped
CVE-2021-44515	Zoho Desktop Central	T1003 T1069 T1087	Mapped
CVE-2021-45382	D-Link Multiple Routers	T1070 T1543	Mapped
CVE-2022-1040	Sophos Firewall	T1040 T1078 T1557 T1574	Mapped
CVE-2022-1388	F5 BIG-IP	T1548	Mapped
CVE-2022-20699	Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers	T1133	Mapped
CVE-2022-20701	Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers	T1078	Mapped
CVE-2022-20708	Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers	T1068	Mapped
CVE-2022-21919	Microsoft Windows	T1068 T1078	Mapped
CVE-2022-21971	Microsoft Windows	T1204.001	Mapped
CVE-2022-21999	Microsoft Windows	T1068 T1078 T1136.001 T1211	Mapped
CVE-2022-22047	Microsoft Windows	T1068 T1078	Mapped
CVE-2022-22718	Microsoft Windows	T1068 T1078	Mapped
CVE-2022-22948	VMware vCenter Server	T1068 T1078 T1212	Mapped
CVE-2022-22954	VMware Workspace ONE Access and Identity Manager	T1505.003	Mapped
CVE-2022-22960	VMware Multiple Products	T1222	Mapped
CVE-2022-22963	VMware Tanzu Spring Cloud	T1505.003	Mapped
CVE-2022-23131	Zabbix Frontend	T1078 T1548	Mapped
CVE-2022-24086	Adobe Commerce and Magento Open Source	T1027 T1213	Mapped
CVE-2022-24521	Microsoft Windows	T1068 T1078	Mapped
CVE-2022-24682	Synacor Zimbra Collaborate Suite (ZCS)	T1185 T1204.001	Mapped
CVE-2022-26138	Atlassian Confluence	T1552.001	Mapped
CVE-2022-26500	Veeam Backup & Replication	T1048 T1078	Mapped
CVE-2022-26501	Veeam Backup & Replication	T1048	Mapped
CVE-2022-26904	Microsoft Windows	T1068 T1078	Mapped
CVE-2022-29303	SolarView Compact	T1505	Mapped
CVE-2022-3038	Google Chromium Network Service	T1204.001 T1574	Mapped
CVE-2022-3075	Google Chromium Mojo	T1204.001	Mapped
CVE-2022-37969	Microsoft Windows	T1068 T1078	Mapped
CVE-2022-41033	Microsoft Windows COM+ Event System Service	T1068	Mapped
CVE-2022-41073	Microsoft Windows	T1068 T1078 T1574	Mapped
CVE-2022-41082	Microsoft Exchange Server	T1078 T1087 T1482 T1505.003 T1567	Mapped
CVE-2022-41125	Microsoft Windows	T1068 T1078	Mapped
CVE-2022-41128	Microsoft Windows	T1070	Mapped
CVE-2022-41328	Fortinet FortiOS	T1037 T1565.001 T1574	Mapped
CVE-2022-42475	Fortinet FortiOS	T1574	Mapped
CVE-2022-47966	Zoho ManageEngine	T1068 T1136.001	Mapped
CVE-2023-0386	Linux Kernel	T1543	Stale
CVE-2023-1389	TP-Link Archer AX21	T1041 T1070	Mapped
CVE-2023-20109	Cisco IOS and IOS XE	T1078	Mapped
CVE-2023-20118	Cisco Small Business RV Series Routers	T1068 T1078 T1505.003	Mapped
CVE-2023-20198	Cisco IOS XE Web UI	T1136	Mapped
CVE-2023-20269	Cisco Adaptive Security Appliance and Firepower Threat Defense	T1078 T1133	Mapped
CVE-2023-20273	Cisco Cisco IOS XE Web UI	T1068 T1078	Mapped
CVE-2023-20867	VMware Tools	T1078	Mapped
CVE-2023-2136	Google Chromium Skia	T1204.001	Mapped
CVE-2023-21674	Microsoft Windows	T1068 T1078	Mapped
CVE-2023-22515	Atlassian Confluence Data Center and Server	T1078 T1136	Mapped
CVE-2023-22952	SugarCRM Multiple Products	T1021.001 T1070.004 T1078 T1083 T1482 T1505.003	Stale
CVE-2023-23397	Microsoft Office	T1078 T1550.002	Mapped
CVE-2023-2533	PaperCut NG/MF	T1547 T1566.002	Mapped
CVE-2023-26360	Adobe ColdFusion	T1003.001 T1036.005 T1484.001 T1505.003	Mapped
CVE-2023-27524	Apache Superset	T1078	Mapped
CVE-2023-27532	Veeam Backup & Replication	T1059.003 T1087 T1133 T1555	Mapped
CVE-2023-27997	Fortinet FortiOS and FortiProxy SSL-VPN	T1136 T1574	Mapped
CVE-2023-28229	Microsoft Windows CNG Key Isolation Service	T1068 T1078	Mapped
CVE-2023-28252	Microsoft Windows	T1003 T1021 T1068 T1078 T1136	Mapped
CVE-2023-2868	Barracuda Networks Email Security Gateway (ESG) Appliance	T1041	Mapped
CVE-2023-32315	Ignite Realtime Openfire	T1505.003	Mapped
CVE-2023-33538	TP-Link Multiple Routers	T1068	Mapped
CVE-2023-34192	Synacor Zimbra Collaboration Suite (ZCS)	T1185	Mapped
CVE-2023-34362	Progress MOVEit Transfer	T1005 T1082 T1136 T1531	Mapped
CVE-2023-35078	Ivanti Endpoint Manager Mobile (EPMM)	T1136 T1213	Mapped
CVE-2023-3519	Citrix NetScaler ADC and NetScaler Gateway	T1574	Mapped
CVE-2023-36884	Microsoft Windows	T1005 T1489 T1553.005	Stale
CVE-2023-38035	Ivanti Sentry	T1557.001 T1571	Mapped
CVE-2023-38831	RARLAB WinRAR	T1005 T1041 T1053 T1204	Mapped
CVE-2023-38950	ZKTeco BioTime	T1005	Mapped
CVE-2023-39780	ASUS RT-AX55 Routers	T1078 T1133	Mapped
CVE-2023-41179	Trend Micro Apex One and Worry-Free Business Security	T1078	Mapped
CVE-2023-42793	JetBrains TeamCity	T1059.003	Mapped
CVE-2023-43770	Roundcube Webmail	T1082 T1189	Mapped
CVE-2023-44221	SonicWall SMA100 Appliances	T1068 T1543 T1548	Mapped
CVE-2023-46604	Apache ActiveMQ	T1053.005	Mapped
CVE-2023-46805	Ivanti Connect Secure and Policy Secure	T1078 T1505.003 T1555	Mapped
CVE-2023-48365	Qlik Sense	T1133	Mapped
CVE-2023-49103	ownCloud ownCloud graphapi	T1005 T1552	Mapped
CVE-2023-4966	Citrix NetScaler ADC and NetScaler Gateway	T1005 T1134.001 T1574	Mapped
CVE-2023-5217	Google Chromium libvpx	T1204.001 T1574	Mapped
CVE-2023-5631	Roundcube Webmail	T1041 T1204.001	Mapped
CVE-2023-6549	Citrix NetScaler ADC and NetScaler Gateway	T1574	Mapped
CVE-2023-7024	Google Chromium WebRTC	T1189 T1574	Mapped
CVE-2024-0769	D-Link DIR-859 Router	T1005	Mapped
CVE-2024-11120	GeoVision Multiple Devices	T1133	Mapped
CVE-2024-11182	MDaemon Email Server	T1567	Mapped
CVE-2024-12686	BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)	T1068	Mapped
CVE-2024-12987	DrayTek Vigor Routers	T1068	Mapped
CVE-2024-13159	Ivanti Endpoint Manager (EPM)	T1087 T1550.002 T1558	Mapped
CVE-2024-13160	Ivanti Endpoint Manager (EPM)	T1087 T1550.002 T1558	Mapped
CVE-2024-13161	Ivanti Endpoint Manager (EPM)	T1087 T1550.002 T1558	Mapped
CVE-2024-20353	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)	T1037 T1653	Mapped
CVE-2024-20359	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)	T1037 T1078	Mapped
CVE-2024-20399	Cisco NX-OS	T1078	Mapped
CVE-2024-20439	Cisco Smart Licensing Utility	T1552	Mapped
CVE-2024-21413	Microsoft Office Outlook	T1566.002	Mapped
CVE-2024-21762	Fortinet FortiOS	T1574	Mapped
CVE-2024-21887	Ivanti Connect Secure and Policy Secure	T1505.003 T1552	Mapped
CVE-2024-21893	Ivanti Connect Secure, Policy Secure, and Neurons	T1078 T1505.003 T1555	Mapped
CVE-2024-23692	Rejetto HTTP File Server	T1005 T1082	Mapped
CVE-2024-24919	Check Point Quantum Security Gateways	T1003.003 T1005	Mapped
CVE-2024-27443	Synacor Zimbra Collaboration Suite (ZCS)	T1041 T1114 T1566.002	Mapped
CVE-2024-29059	Microsoft .NET Framework	T1068	Mapped
CVE-2024-30051	Microsoft DWM Core Library	T1068	Mapped
CVE-2024-34102	Adobe Commerce and Magento Open Source	T1005	Mapped
CVE-2024-37085	VMware ESXi	T1068 T1078	Mapped
CVE-2024-38080	Microsoft Windows	T1068	Mapped
CVE-2024-38112	Microsoft Windows	T1189 T1204.001	Mapped
CVE-2024-38475	Apache HTTP Server	T1005	Mapped
CVE-2024-41710	Mitel SIP Phones	T1068	Mapped
CVE-2024-41713	Mitel MiCollab	T1005 T1068	Mapped
CVE-2024-42009	Roundcube Webmail	T1056 T1114 T1566.002	Mapped
CVE-2024-45195	Apache OFBiz	T1133 T1498.001	Mapped
CVE-2024-4577	PHP Group PHP	T1003 T1003.001 T1041 T1053 T1068 T1543 T1570	Mapped
CVE-2024-4671	Google Chromium	T1189	Mapped
CVE-2024-48248	NAKIVO Backup and Replication	T1003 T1005	Mapped
CVE-2024-4879	ServiceNow Utah, Vancouver, and Washington DC Now Platform	T1005	Mapped
CVE-2024-4885	Progress WhatsUp Gold	T1068	Mapped
CVE-2024-49035	Microsoft Partner Center	T1068	Mapped
CVE-2024-4947	Google Chromium V8	T1189	Mapped
CVE-2024-4978	Justice AV Solutions Viewer	T1005	Mapped
CVE-2024-50302	Linux Kernel	T1005	Mapped
CVE-2024-5217	ServiceNow Utah, Vancouver, and Washington DC Now Platform	T1005	Mapped
CVE-2024-5274	Google Chromium V8	T1189	Mapped
CVE-2024-53104	Linux Kernel	T1068	Mapped
CVE-2024-53150	Linux Kernel	T1005	Mapped
CVE-2024-53197	Linux Kernel	T1068	Mapped
CVE-2024-53704	SonicWall SonicOS	T1021.001 T1083 T1199 T1212	Mapped
CVE-2024-54085	AMI MegaRAC SPx	T1068 T1495	Mapped
CVE-2024-55550	Mitel MiCollab	T1005 T1041	Mapped
CVE-2024-55591	Fortinet FortiOS and FortiProxy	T1021 T1068 T1078 T1555	Mapped
CVE-2024-57727	SimpleHelp SimpleHelp	T1003 T1552.001 T1552.004	Mapped
CVE-2024-57968	Advantive VeraCore	T1078	Mapped
CVE-2025-0108	Palo Alto Networks PAN-OS	T1565.001	Mapped
CVE-2025-0111	Palo Alto Networks PAN-OS	T1005 T1068	Mapped
CVE-2025-0282	Ivanti Connect Secure, Policy Secure, and ZTA Gateways	T1003	Mapped
CVE-2025-0411	7-Zip 7-Zip	T1553.005	Mapped
CVE-2025-0994	Trimble Cityworks	T1068	Mapped
CVE-2025-1976	Broadcom Brocade Fabric OS	T1068	Mapped
CVE-2025-21333	Microsoft Windows	T1003 T1068	Mapped
CVE-2025-21334	Microsoft Windows	T1003 T1068	Mapped
CVE-2025-21335	Microsoft Windows	T1003 T1068	Mapped
CVE-2025-21391	Microsoft Windows	T1068	Mapped
CVE-2025-21418	Microsoft Windows	T1005 T1068	Mapped
CVE-2025-21480	Qualcomm Multiple Chipsets	T1495	Mapped
CVE-2025-21590	Juniper Junos OS	T1068	Mapped
CVE-2025-22224	VMware ESXi and Workstation	T1611	Mapped
CVE-2025-22225	VMware ESXi	T1068 T1611	Mapped
CVE-2025-22226	VMware ESXi, Workstation, and Fusion	T1005 T1611	Mapped
CVE-2025-24016	Wazuh Wazuh Server	T1078	Mapped
CVE-2025-24054	Microsoft Windows	T1555	Mapped
CVE-2025-24085	Apple Multiple Products	T1068	Mapped
CVE-2025-24201	Apple Multiple Products	T1189	Mapped
CVE-2025-24991	Microsoft Windows	T1005	Mapped
CVE-2025-24993	Microsoft Windows	T1068 T1204 T1565	Mapped
CVE-2025-25181	Advantive VeraCore	T1068	Mapped
CVE-2025-25257	Fortinet FortiWeb	T1068	Mapped
CVE-2025-27363	FreeType FreeType	T1574	Mapped
CVE-2025-2783	Google Chromium Mojo	T1548	Mapped
CVE-2025-30400	Microsoft Windows	T1068	Mapped
CVE-2025-31161	CrushFTP CrushFTP	T1078 T1136	Mapped
CVE-2025-31200	Apple Multiple Products	T1557	Stale
CVE-2025-31201	Apple Multiple Products	T1557	Stale
CVE-2025-31324	SAP NetWeaver	T1505.003	Mapped
CVE-2025-32701	Microsoft Windows	T1003.001 T1068 T1543	Mapped
CVE-2025-32706	Microsoft Windows	T1003.001 T1068 T1543	Mapped
CVE-2025-32709	Microsoft Windows	T1003 T1068 T1543	Mapped
CVE-2025-32756	Fortinet Multiple Products	T1003 T1041 T1070.004 T1133	Mapped
CVE-2025-33053	Microsoft Windows	T1041 T1056.001 T1543	Mapped
CVE-2025-35939	Craft CMS Craft CMS	T1505.003	Mapped
CVE-2025-3928	Commvault Web Server	T1505.003	Mapped
CVE-2025-42999	SAP NetWeaver	T1505.003	Mapped
CVE-2025-43200	Apple Multiple Products	T1005	Mapped
CVE-2025-4427	Ivanti Endpoint Manager Mobile (EPMM)	T1505.003	Mapped
CVE-2025-4428	Ivanti Endpoint Manager Mobile (EPMM)	T1543	Mapped
CVE-2025-4632	Samsung MagicINFO 9 Server	T1068	Mapped
CVE-2025-47812	Wing FTP Server Wing FTP Server	T1068	Mapped
CVE-2025-48927	TeleMessage TM SGNL	T1005 T1212 T1555	Mapped
CVE-2025-48928	TeleMessage TM SGNL	T1005 T1212 T1555	Mapped
CVE-2025-49704	Microsoft SharePoint	T1059.003	Mapped
CVE-2025-49706	Microsoft SharePoint	T1059.003 T1505	Mapped
CVE-2025-5419	Google Chromium V8	T1189	Mapped
CVE-2025-54309	CrushFTP CrushFTP	T1021 T1068 T1567	Mapped
CVE-2025-5777	Citrix NetScaler ADC and Gateway	T1555	Mapped
CVE-2025-6554	Google Chromium V8	T1189	Mapped
CVE-2025-6558	Google Chromium	T1189	Mapped