Log sources › ApplicationLog:IIS
ApplicationLog:IIS
Inverted view: what can be detected if this is the log you have. Windows
1
channels
1
analytics
1
techniques
157
KEV CVEs reachable
"Reachable" means: a KEV CVE has a public mapping to a technique, and MITRE's analytic for that technique names this log source. It is a statement about published knowledge, not about whether any particular rule fires.
Channels
| Channel | Data components | Analytics | Techniques |
|---|---|---|---|
IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) |
DC0038 Application Log Content | AN0219 | 1 |
Techniques detectable from this source
| Technique | Tactics | Sigma rules | KEV CVEs |
|---|---|---|---|
| T1190 Exploit Public-Facing Application | initial access | 149 | 157 |
KEV CVEs reachable from this source
| CVE | Vendor / product | Via technique | State |
|---|---|---|---|
| CVE-2009-3960 | Adobe BlazeDS | T1190 | Mapped |
| CVE-2010-2861 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2013-0625 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2013-0629 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2013-0631 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2013-0632 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2014-6271 | GNU Bourne-Again Shell (Bash) | T1190 | Mapped |
| CVE-2014-7169 | GNU Bourne-Again Shell (Bash) | T1190 | Mapped |
| CVE-2016-10033 | PHP PHPMailer | T1190 | Mapped |
| CVE-2016-4437 | Apache Shiro | T1190 | Mapped |
| CVE-2017-12637 | SAP NetWeaver | T1190 | Mapped |
| CVE-2017-5638 | Apache Struts | T1190 | Mapped |
| CVE-2017-9805 | Apache Struts | T1190 | Mapped |
| CVE-2017-9822 | DotNetNuke (DNN) DotNetNuke (DNN) | T1190 | Mapped |
| CVE-2018-11776 | Apache Struts | T1190 | Mapped |
| CVE-2018-13379 | Fortinet FortiOS | T1190 | Mapped |
| CVE-2018-15961 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2018-4939 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2018-6789 | Exim Exim | T1190 | Mapped |
| CVE-2018-7600 | Drupal Drupal Core | T1190 | Mapped |
| CVE-2019-0604 | Microsoft SharePoint | T1190 | Mapped |
| CVE-2019-11634 | Citrix Workspace Application and Receiver for Windows | T1190 | Mapped |
| CVE-2019-1653 | Cisco Small Business RV320 and RV325 Routers | T1190 | Mapped |
| CVE-2019-17558 | Apache Solr | T1190 | Mapped |
| CVE-2019-18935 | Progress Telerik UI for ASP.NET AJAX | T1190 | Mapped |
| CVE-2020-0688 | Microsoft Exchange Server | T1190 | Mapped |
| CVE-2020-15505 | Ivanti MobileIron Multiple Products | T1190 | Mapped |
| CVE-2020-17530 | Apache Struts | T1190 | Mapped |
| CVE-2020-29557 | D-Link DIR-825 R1 Devices | T1190 | Mapped |
| CVE-2020-5902 | F5 BIG-IP | T1190 | Stale |
| CVE-2021-21972 | VMware vCenter Server | T1190 | Mapped |
| CVE-2021-21973 | VMware vCenter Server and Cloud Foundation | T1190 | Mapped |
| CVE-2021-21975 | VMware vRealize Operations Manager API | T1190 | Mapped |
| CVE-2021-22005 | VMware vCenter Server | T1190 | Mapped |
| CVE-2021-22017 | VMware vCenter Server | T1190 | Mapped |
| CVE-2021-22204 | Perl Exiftool | T1190 | Mapped |
| CVE-2021-22205 | GitLab Community and Enterprise Editions | T1190 | Mapped |
| CVE-2021-22893 | Ivanti Pulse Connect Secure | T1190 | Mapped |
| CVE-2021-22986 | F5 BIG-IP and BIG-IQ Centralized Management | T1190 | Mapped |
| CVE-2021-26085 | Atlassian Confluence Server | T1190 | Mapped |
| CVE-2021-26858 | Microsoft Exchange Server | T1190 | Mapped |
| CVE-2021-27065 | Microsoft Exchange Server | T1190 | Mapped |
| CVE-2021-27102 | Accellion FTA | T1190 | Mapped |
| CVE-2021-27103 | Accellion FTA | T1190 | Mapped |
| CVE-2021-27104 | Accellion FTA | T1190 | Mapped |
| CVE-2021-27860 | FatPipe WARP, IPVPN, and MPVPN software | T1190 | Mapped |
| CVE-2021-31166 | Microsoft HTTP Protocol Stack | T1190 | Mapped |
| CVE-2021-3129 | Laravel Ignition | T1190 | Mapped |
| CVE-2021-34473 | Microsoft Exchange Server | T1190 | Mapped |
| CVE-2021-34523 | Microsoft Exchange Server | T1190 | Mapped |
| CVE-2021-35394 | Realtek Jungle Software Development Kit (SDK) | T1190 | Mapped |
| CVE-2021-35464 | ForgeRock Access Management (AM) | T1190 | Mapped |
| CVE-2021-36380 | Sunhillo SureLine | T1190 | Mapped |
| CVE-2021-37415 | Zoho ManageEngine ServiceDesk Plus (SDP) | T1190 | Mapped |
| CVE-2021-39144 | XStream XStream | T1190 | Mapped |
| CVE-2021-39226 | Grafana Labs Grafana | T1190 | Mapped |
| CVE-2021-40539 | Zoho ManageEngine | T1190 | Mapped |
| CVE-2021-40655 | D-Link DIR-605 Router | T1190 | Mapped |
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | T1190 | Mapped |
| CVE-2021-44228 | Apache Log4j2 | T1190 | Mapped |
| CVE-2021-44515 | Zoho Desktop Central | T1190 | Mapped |
| CVE-2021-44529 | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) | T1190 | Mapped |
| CVE-2021-45382 | D-Link Multiple Routers | T1190 | Mapped |
| CVE-2022-0028 | Palo Alto Networks PAN-OS | T1190 | Mapped |
| CVE-2022-1040 | Sophos Firewall | T1190 | Mapped |
| CVE-2022-20700 | Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers | T1190 | Mapped |
| CVE-2022-20708 | Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers | T1190 | Mapped |
| CVE-2022-20821 | Cisco IOS XR | T1190 | Mapped |
| CVE-2022-22947 | VMware Spring Cloud Gateway | T1190 | Mapped |
| CVE-2022-22963 | VMware Tanzu Spring Cloud | T1190 | Mapped |
| CVE-2022-22965 | VMware Spring Framework | T1190 | Mapped |
| CVE-2022-23131 | Zabbix Frontend | T1190 | Mapped |
| CVE-2022-24086 | Adobe Commerce and Magento Open Source | T1190 | Mapped |
| CVE-2022-26134 | Atlassian Confluence Server/Data Center | T1190 | Mapped |
| CVE-2022-26258 | D-Link DIR-820L | T1190 | Mapped |
| CVE-2022-26500 | Veeam Backup & Replication | T1190 | Mapped |
| CVE-2022-26501 | Veeam Backup & Replication | T1190 | Mapped |
| CVE-2022-28810 | Zoho ManageEngine | T1190 | Mapped |
| CVE-2022-29464 | WSO2 Multiple Products | T1190 | Mapped |
| CVE-2022-35914 | Teclib GLPI | T1190 | Mapped |
| CVE-2022-36804 | Atlassian Bitbucket Server and Data Center | T1190 | Mapped |
| CVE-2022-39197 | Fortra Cobalt Strike | T1190 | Mapped |
| CVE-2022-40684 | Fortinet Multiple Products | T1190 | Mapped |
| CVE-2022-42475 | Fortinet FortiOS | T1190 | Mapped |
| CVE-2022-42948 | Fortra Cobalt Strike | T1190 | Mapped |
| CVE-2022-43939 | Hitachi Vantara Pentaho Business Analytics (BA) Server | T1190 | Mapped |
| CVE-2022-47966 | Zoho ManageEngine | T1190 | Mapped |
| CVE-2023-0669 | Fortra GoAnywhere MFT | T1190 | Mapped |
| CVE-2023-20198 | Cisco IOS XE Web UI | T1190 | Mapped |
| CVE-2023-20887 | VMware Aria Operations for Networks | T1190 | Mapped |
| CVE-2023-22515 | Atlassian Confluence Data Center and Server | T1190 | Mapped |
| CVE-2023-22518 | Atlassian Confluence Data Center and Server | T1190 | Mapped |
| CVE-2023-22952 | SugarCRM Multiple Products | T1190 | Stale |
| CVE-2023-26359 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2023-26360 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2023-27350 | PaperCut MF/NG | T1190 | Mapped |
| CVE-2023-27524 | Apache Superset | T1190 | Mapped |
| CVE-2023-27997 | Fortinet FortiOS and FortiProxy SSL-VPN | T1190 | Mapped |
| CVE-2023-29298 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2023-29300 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2023-29492 | Novi Survey Novi Survey | T1190 | Mapped |
| CVE-2023-33246 | Apache RocketMQ | T1190 | Mapped |
| CVE-2023-34362 | Progress MOVEit Transfer | T1190 | Mapped |
| CVE-2023-35078 | Ivanti Endpoint Manager Mobile (EPMM) | T1190 | Mapped |
| CVE-2023-35081 | Ivanti Endpoint Manager Mobile (EPMM) | T1190 | Mapped |
| CVE-2023-3519 | Citrix NetScaler ADC and NetScaler Gateway | T1190 | Mapped |
| CVE-2023-36844 | Juniper Junos OS | T1190 | Mapped |
| CVE-2023-36845 | Juniper Junos OS | T1190 | Mapped |
| CVE-2023-36846 | Juniper Junos OS | T1190 | Mapped |
| CVE-2023-36847 | Juniper Junos OS | T1190 | Mapped |
| CVE-2023-36851 | Juniper Junos OS | T1190 | Mapped |
| CVE-2023-38035 | Ivanti Sentry | T1190 | Mapped |
| CVE-2023-38203 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2023-38205 | Adobe ColdFusion | T1190 | Mapped |
| CVE-2023-38950 | ZKTeco BioTime | T1190 | Mapped |
| CVE-2023-42793 | JetBrains TeamCity | T1190 | Mapped |
| CVE-2023-44487 | IETF HTTP/2 | T1190 | Mapped |
| CVE-2023-46604 | Apache ActiveMQ | T1190 | Mapped |
| CVE-2023-46805 | Ivanti Connect Secure and Policy Secure | T1190 | Mapped |
| CVE-2023-48365 | Qlik Sense | T1190 | Mapped |
| CVE-2023-48788 | Fortinet FortiClient EMS | T1190 | Mapped |
| CVE-2023-49103 | ownCloud ownCloud graphapi | T1190 | Mapped |
| CVE-2023-7101 | Spreadsheet::ParseExcel Spreadsheet::ParseExcel | T1190 | Mapped |
| CVE-2024-0769 | D-Link DIR-859 Router | T1190 | Mapped |
| CVE-2024-13159 | Ivanti Endpoint Manager (EPM) | T1190 | Mapped |
| CVE-2024-13160 | Ivanti Endpoint Manager (EPM) | T1190 | Mapped |
| CVE-2024-13161 | Ivanti Endpoint Manager (EPM) | T1190 | Mapped |
| CVE-2024-20353 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | T1190 | Mapped |
| CVE-2024-20953 | Oracle Agile Product Lifecycle Management (PLM) | T1190 | Mapped |
| CVE-2024-21762 | Fortinet FortiOS | T1190 | Mapped |
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure | T1190 | Mapped |
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons | T1190 | Mapped |
| CVE-2024-27198 | JetBrains TeamCity | T1190 | Mapped |
| CVE-2024-34102 | Adobe Commerce and Magento Open Source | T1190 | Mapped |
| CVE-2024-38475 | Apache HTTP Server | T1190 | Mapped |
| CVE-2024-4358 | Progress Telerik Report Server | T1190 | Mapped |
| CVE-2024-4577 | PHP Group PHP | T1190 | Mapped |
| CVE-2024-48248 | NAKIVO Backup and Replication | T1190 | Mapped |
| CVE-2024-4879 | ServiceNow Utah, Vancouver, and Washington DC Now Platform | T1190 | Mapped |
| CVE-2024-55550 | Mitel MiCollab | T1190 | Mapped |
| CVE-2024-57727 | SimpleHelp SimpleHelp | T1190 | Mapped |
| CVE-2025-0108 | Palo Alto Networks PAN-OS | T1190 | Mapped |
| CVE-2025-0282 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways | T1190 | Mapped |
| CVE-2025-1316 | Edimax IC-7100 IP Camera | T1190 | Mapped |
| CVE-2025-22457 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways | T1190 | Mapped |
| CVE-2025-23006 | SonicWall SMA1000 Appliances | T1190 | Mapped |
| CVE-2025-25257 | Fortinet FortiWeb | T1190 | Mapped |
| CVE-2025-34028 | Commvault Command Center | T1190 | Mapped |
| CVE-2025-35939 | Craft CMS Craft CMS | T1190 | Mapped |
| CVE-2025-42599 | Qualitia Active! Mail | T1190 | Mapped |
| CVE-2025-42999 | SAP NetWeaver | T1190 | Mapped |
| CVE-2025-4427 | Ivanti Endpoint Manager Mobile (EPMM) | T1190 | Mapped |
| CVE-2025-4428 | Ivanti Endpoint Manager Mobile (EPMM) | T1190 | Mapped |
| CVE-2025-49704 | Microsoft SharePoint | T1190 | Mapped |
| CVE-2025-49706 | Microsoft SharePoint | T1190 | Mapped |
| CVE-2025-53770 | Microsoft SharePoint | T1190 | Mapped |
| CVE-2025-5777 | Citrix NetScaler ADC and Gateway | T1190 | Mapped |