Techniques › T1608.001 › AN1956
AN1956 Analytic 1956
PRE · attack.mitre.org · ATT&CK Enterprise v19.2
<p>If infrastructure or patterns in malware have been previously identified, internet scanning may uncover when an adversary has staged malware to make it accessible for targeting. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle, such as User Execution or Ingress Tool Transfer .</p>
- Detects
- T1608.001 Upload Malware
- Part of
- DET0824 Detection of Upload Malware
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| Internet Scan | None | DC0104 Response Content |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2019-0604 | Microsoft SharePoint | Mapped |
| CVE-2021-44228 | Apache Log4j2 | Mapped |
| CVE-2023-33246 | Apache RocketMQ | Mapped |
| CVE-2024-20353 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Mapped |
| CVE-2024-37085 | VMware ESXi | Mapped |
| CVE-2024-54085 | AMI MegaRAC SPx | Mapped |
| CVE-2025-32701 | Microsoft Windows | Mapped |
| CVE-2025-32706 | Microsoft Windows | Mapped |
| CVE-2025-32709 | Microsoft Windows | Mapped |
| CVE-2025-32756 | Fortinet Multiple Products | Mapped |
| CVE-2025-4632 | Samsung MagicINFO 9 Server | Mapped |