kevmap

Log sources › docker:events

docker:events

Inverted view: what can be detected if this is the log you have. Containers

9
channels
8
analytics
8
techniques
171
KEV CVEs reachable

"Reachable" means: a KEV CVE has a public mapping to a technique, and MITRE's analytic for that technique names this log source. It is a statement about published knowledge, not about whether any particular rule fires.

Channels

ChannelData componentsAnalyticsTechniques
Container exited with non-zero code repeatedly in short period DC0038 Application Log Content AN0588 1
Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container DC0032 Process Creation AN0222 1
container exec rm|container stop --force DC0064 Command Execution AN0416 1
created,started: new container from untrusted registry or unexpected entrypoint DC0072 Container Creation AN1317 1
docker run with restart=always or modifying init DC0072 Container Creation AN1578 1
docker.events.json DC0028 Image Metadata AN0358 1
exec_create: docker exec events targeting running containers from non-CI sources DC0077 Container Start AN0233 1
remote API calls to /containers/create or /containers/{id}/start DC0085 Network Traffic Content AN0693 1
start DC0077 Container Start AN1317 1

Techniques detectable from this source

TechniqueTacticsSigma rulesKEV CVEs
T1036 Masqueradingstealth402
T1059.013 Container CLI/APIexecution00
T1190 Exploit Public-Facing Applicationinitial access149157
T1204 User Executionexecution102
T1485 Data Destructionimpact206
T1499 Endpoint Denial of Serviceimpact37
T1543 Create or Modify System Processpersistence, privilege escalation99
T1610 Deploy Containerexecution00

KEV CVEs reachable from this source

CVEVendor / productVia techniqueState
CVE-2009-3960Adobe BlazeDS T1190 Mapped
CVE-2010-2861Adobe ColdFusion T1190 Mapped
CVE-2013-0625Adobe ColdFusion T1190 Mapped
CVE-2013-0629Adobe ColdFusion T1190 Mapped
CVE-2013-0631Adobe ColdFusion T1190 Mapped
CVE-2013-0632Adobe ColdFusion T1190 Mapped
CVE-2014-6271GNU Bourne-Again Shell (Bash) T1190 Mapped
CVE-2014-7169GNU Bourne-Again Shell (Bash) T1190 Mapped
CVE-2016-10033PHP PHPMailer T1190 Mapped
CVE-2016-4437Apache Shiro T1190 Mapped
CVE-2017-12637SAP NetWeaver T1190 Mapped
CVE-2017-5638Apache Struts T1190 Mapped
CVE-2017-9805Apache Struts T1190 Mapped
CVE-2017-9822DotNetNuke (DNN) DotNetNuke (DNN) T1190 Mapped
CVE-2018-11776Apache Struts T1190 Mapped
CVE-2018-13379Fortinet FortiOS T1190 Mapped
CVE-2018-15961Adobe ColdFusion T1190 Mapped
CVE-2018-4939Adobe ColdFusion T1190 Mapped
CVE-2018-6789Exim Exim T1190 Mapped
CVE-2018-7600Drupal Drupal Core T1190 T1485 Mapped
CVE-2019-0604Microsoft SharePoint T1190 Mapped
CVE-2019-11634Citrix Workspace Application and Receiver for Windows T1190 Mapped
CVE-2019-1653Cisco Small Business RV320 and RV325 Routers T1190 Mapped
CVE-2019-17558Apache Solr T1190 Mapped
CVE-2019-18935Progress Telerik UI for ASP.NET AJAX T1190 Mapped
CVE-2020-0688Microsoft Exchange Server T1190 Mapped
CVE-2020-15505Ivanti MobileIron Multiple Products T1190 Mapped
CVE-2020-17530Apache Struts T1190 Mapped
CVE-2020-29557D-Link DIR-825 R1 Devices T1190 Mapped
CVE-2020-5735Amcrest Cameras and Network Video Recorder (NVR) T1499 Mapped
CVE-2020-5902F5 BIG-IP T1190 Stale
CVE-2021-21972VMware vCenter Server T1190 Mapped
CVE-2021-21973VMware vCenter Server and Cloud Foundation T1190 Mapped
CVE-2021-21975VMware vRealize Operations Manager API T1190 Mapped
CVE-2021-22005VMware vCenter Server T1190 Mapped
CVE-2021-22017VMware vCenter Server T1190 Mapped
CVE-2021-22204Perl Exiftool T1190 Mapped
CVE-2021-22205GitLab Community and Enterprise Editions T1190 Mapped
CVE-2021-22893Ivanti Pulse Connect Secure T1190 Mapped
CVE-2021-22986F5 BIG-IP and BIG-IQ Centralized Management T1190 T1485 Mapped
CVE-2021-26085Atlassian Confluence Server T1190 Mapped
CVE-2021-26858Microsoft Exchange Server T1190 Mapped
CVE-2021-27065Microsoft Exchange Server T1190 Mapped
CVE-2021-27102Accellion FTA T1190 Mapped
CVE-2021-27103Accellion FTA T1190 Mapped
CVE-2021-27104Accellion FTA T1190 Mapped
CVE-2021-27860FatPipe WARP, IPVPN, and MPVPN software T1190 Mapped
CVE-2021-31166Microsoft HTTP Protocol Stack T1190 Mapped
CVE-2021-3129Laravel Ignition T1190 Mapped
CVE-2021-34473Microsoft Exchange Server T1190 Mapped
CVE-2021-34523Microsoft Exchange Server T1190 Mapped
CVE-2021-35394Realtek Jungle Software Development Kit (SDK) T1190 T1499 Mapped
CVE-2021-35464ForgeRock Access Management (AM) T1190 Mapped
CVE-2021-36380Sunhillo SureLine T1190 Mapped
CVE-2021-37415Zoho ManageEngine ServiceDesk Plus (SDP) T1190 Mapped
CVE-2021-39144XStream XStream T1190 Mapped
CVE-2021-39226Grafana Labs Grafana T1190 T1485 Mapped
CVE-2021-40539Zoho ManageEngine T1190 Mapped
CVE-2021-40655D-Link DIR-605 Router T1190 Mapped
CVE-2021-44077Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus T1190 Mapped
CVE-2021-44228Apache Log4j2 T1190 Mapped
CVE-2021-44515Zoho Desktop Central T1190 Mapped
CVE-2021-44529Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) T1190 Mapped
CVE-2021-45382D-Link Multiple Routers T1190 T1543 Mapped
CVE-2022-0028Palo Alto Networks PAN-OS T1190 Mapped
CVE-2022-1040Sophos Firewall T1190 Mapped
CVE-2022-20700Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers T1190 Mapped
CVE-2022-20708Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers T1190 Mapped
CVE-2022-20821Cisco IOS XR T1190 Mapped
CVE-2022-22947VMware Spring Cloud Gateway T1190 Mapped
CVE-2022-22963VMware Tanzu Spring Cloud T1190 Mapped
CVE-2022-22965VMware Spring Framework T1190 Mapped
CVE-2022-23131Zabbix Frontend T1190 Mapped
CVE-2022-24086Adobe Commerce and Magento Open Source T1190 Mapped
CVE-2022-26134Atlassian Confluence Server/Data Center T1190 Mapped
CVE-2022-26258D-Link DIR-820L T1190 Mapped
CVE-2022-26500Veeam Backup & Replication T1036 T1190 Mapped
CVE-2022-26501Veeam Backup & Replication T1036 T1190 Mapped
CVE-2022-28810Zoho ManageEngine T1190 Mapped
CVE-2022-29464WSO2 Multiple Products T1190 Mapped
CVE-2022-35914Teclib GLPI T1190 Mapped
CVE-2022-36804Atlassian Bitbucket Server and Data Center T1190 Mapped
CVE-2022-39197Fortra Cobalt Strike T1190 Mapped
CVE-2022-40684Fortinet Multiple Products T1190 Mapped
CVE-2022-42475Fortinet FortiOS T1190 Mapped
CVE-2022-42948Fortra Cobalt Strike T1190 Mapped
CVE-2022-43939Hitachi Vantara Pentaho Business Analytics (BA) Server T1190 Mapped
CVE-2022-47966Zoho ManageEngine T1190 Mapped
CVE-2023-0386Linux Kernel T1543 Stale
CVE-2023-0669Fortra GoAnywhere MFT T1190 Mapped
CVE-2023-20109Cisco IOS and IOS XE T1499 Mapped
CVE-2023-20198Cisco IOS XE Web UI T1190 Mapped
CVE-2023-20887VMware Aria Operations for Networks T1190 Mapped
CVE-2023-22515Atlassian Confluence Data Center and Server T1190 Mapped
CVE-2023-22518Atlassian Confluence Data Center and Server T1190 Mapped
CVE-2023-22952SugarCRM Multiple Products T1190 Stale
CVE-2023-26359Adobe ColdFusion T1190 Mapped
CVE-2023-26360Adobe ColdFusion T1190 Mapped
CVE-2023-27350PaperCut MF/NG T1190 Mapped
CVE-2023-27524Apache Superset T1190 Mapped
CVE-2023-27997Fortinet FortiOS and FortiProxy SSL-VPN T1190 Mapped
CVE-2023-29298Adobe ColdFusion T1190 Mapped
CVE-2023-29300Adobe ColdFusion T1190 Mapped
CVE-2023-29492Novi Survey Novi Survey T1190 Mapped
CVE-2023-33246Apache RocketMQ T1190 Mapped
CVE-2023-34362Progress MOVEit Transfer T1190 Mapped
CVE-2023-35078Ivanti Endpoint Manager Mobile (EPMM) T1190 Mapped
CVE-2023-35081Ivanti Endpoint Manager Mobile (EPMM) T1190 Mapped
CVE-2023-3519Citrix NetScaler ADC and NetScaler Gateway T1190 Mapped
CVE-2023-36844Juniper Junos OS T1190 Mapped
CVE-2023-36845Juniper Junos OS T1190 Mapped
CVE-2023-36846Juniper Junos OS T1190 Mapped
CVE-2023-36847Juniper Junos OS T1190 Mapped
CVE-2023-36851Juniper Junos OS T1190 Mapped
CVE-2023-38035Ivanti Sentry T1190 Mapped
CVE-2023-38203Adobe ColdFusion T1190 Mapped
CVE-2023-38205Adobe ColdFusion T1190 Mapped
CVE-2023-38831RARLAB WinRAR T1204 Mapped
CVE-2023-38950ZKTeco BioTime T1190 Mapped
CVE-2023-42793JetBrains TeamCity T1190 Mapped
CVE-2023-44221SonicWall SMA100 Appliances T1543 Mapped
CVE-2023-44487IETF HTTP/2 T1190 T1499 Mapped
CVE-2023-46604Apache ActiveMQ T1190 Mapped
CVE-2023-46805Ivanti Connect Secure and Policy Secure T1190 Mapped
CVE-2023-48365Qlik Sense T1190 Mapped
CVE-2023-48788Fortinet FortiClient EMS T1190 Mapped
CVE-2023-49103ownCloud ownCloud graphapi T1190 Mapped
CVE-2023-6549Citrix NetScaler ADC and NetScaler Gateway T1499 Mapped
CVE-2023-7101Spreadsheet::ParseExcel Spreadsheet::ParseExcel T1190 Mapped
CVE-2024-0769D-Link DIR-859 Router T1190 Mapped
CVE-2024-13159Ivanti Endpoint Manager (EPM) T1190 Mapped
CVE-2024-13160Ivanti Endpoint Manager (EPM) T1190 Mapped
CVE-2024-13161Ivanti Endpoint Manager (EPM) T1190 Mapped
CVE-2024-20353Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) T1190 Mapped
CVE-2024-20953Oracle Agile Product Lifecycle Management (PLM) T1190 Mapped
CVE-2024-21762Fortinet FortiOS T1190 Mapped
CVE-2024-21887Ivanti Connect Secure and Policy Secure T1190 Mapped
CVE-2024-21893Ivanti Connect Secure, Policy Secure, and Neurons T1190 Mapped
CVE-2024-27198JetBrains TeamCity T1190 Mapped
CVE-2024-34102Adobe Commerce and Magento Open Source T1190 Mapped
CVE-2024-38475Apache HTTP Server T1190 Mapped
CVE-2024-4358Progress Telerik Report Server T1190 Mapped
CVE-2024-4577PHP Group PHP T1190 T1543 Mapped
CVE-2024-48248NAKIVO Backup and Replication T1190 Mapped
CVE-2024-4879ServiceNow Utah, Vancouver, and Washington DC Now Platform T1190 Mapped
CVE-2024-54085AMI MegaRAC SPx T1499 Mapped
CVE-2024-55550Mitel MiCollab T1190 Mapped
CVE-2024-57727SimpleHelp SimpleHelp T1190 Mapped
CVE-2025-0108Palo Alto Networks PAN-OS T1190 Mapped
CVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways T1190 Mapped
CVE-2025-1316Edimax IC-7100 IP Camera T1190 Mapped
CVE-2025-21391Microsoft Windows T1485 Mapped
CVE-2025-22457Ivanti Connect Secure, Policy Secure, and ZTA Gateways T1190 Mapped
CVE-2025-23006SonicWall SMA1000 Appliances T1190 Mapped
CVE-2025-24993Microsoft Windows T1204 Mapped
CVE-2025-25181Advantive VeraCore T1485 Mapped
CVE-2025-25257Fortinet FortiWeb T1190 T1485 Mapped
CVE-2025-32701Microsoft Windows T1543 Mapped
CVE-2025-32706Microsoft Windows T1543 Mapped
CVE-2025-32709Microsoft Windows T1543 Mapped
CVE-2025-33053Microsoft Windows T1543 Mapped
CVE-2025-34028Commvault Command Center T1190 Mapped
CVE-2025-35939Craft CMS Craft CMS T1190 Mapped
CVE-2025-42599Qualitia Active! Mail T1190 T1499 Mapped
CVE-2025-42999SAP NetWeaver T1190 Mapped
CVE-2025-4427Ivanti Endpoint Manager Mobile (EPMM) T1190 Mapped
CVE-2025-4428Ivanti Endpoint Manager Mobile (EPMM) T1190 T1543 Mapped
CVE-2025-49704Microsoft SharePoint T1190 Mapped
CVE-2025-49706Microsoft SharePoint T1190 Mapped
CVE-2025-53770Microsoft SharePoint T1190 Mapped
CVE-2025-5777Citrix NetScaler ADC and Gateway T1190 Mapped