Log sources › Windows:perfmon
Windows:perfmon
Inverted view: what can be detected if this is the log you have. Windows
4
channels
4
analytics
4
techniques
21
KEV CVEs reachable
"Reachable" means: a KEV CVE has a public mapping to a technique, and MITRE's analytic for that technique names this log source. It is a statement about published knowledge, not about whether any particular rule fires.
Channels
| Channel | Data components | Analytics | Techniques |
|---|---|---|---|
High sustained CPU usage by a single process |
DC0018 Host Status | AN0741 | 1 |
Sudden spike in outbound throughput without corresponding inbound traffic |
DC0018 Host Status | AN1140 | 1 |
Sudden spikes in CPU/Memory usage linked to specific application processes |
DC0018 Host Status | AN1165 | 1 |
Sustained CPU/memory exhaustion by service process (e.g., w3wp.exe) |
DC0018 Host Status | AN0489 | 1 |
Techniques detectable from this source
| Technique | Tactics | Sigma rules | KEV CVEs |
|---|---|---|---|
| T1496 Resource Hijacking | impact | 13 | 19 |
| T1498.002 Reflection Amplification | impact | 0 | 0 |
| T1499.002 Service Exhaustion Flood | impact | 0 | 2 |
| T1499.003 Application Exhaustion Flood | impact | 0 | 0 |
KEV CVEs reachable from this source
| CVE | Vendor / product | Via technique | State |
|---|---|---|---|
| CVE-2017-9822 | DotNetNuke (DNN) DotNetNuke (DNN) | T1496 | Mapped |
| CVE-2018-11776 | Apache Struts | T1496 | Mapped |
| CVE-2018-7600 | Drupal Drupal Core | T1496 | Mapped |
| CVE-2019-18935 | Progress Telerik UI for ASP.NET AJAX | T1496 | Mapped |
| CVE-2020-8515 | DrayTek Multiple Vigor Routers | T1496 | Mapped |
| CVE-2021-22205 | GitLab Community and Enterprise Editions | T1496 | Mapped |
| CVE-2021-26084 | Atlassian Confluence Server and Data Center | T1496 | Mapped |
| CVE-2021-35394 | Realtek Jungle Software Development Kit (SDK) | T1496 | Mapped |
| CVE-2021-44228 | Apache Log4j2 | T1496 | Mapped |
| CVE-2021-45382 | D-Link Multiple Routers | T1499.002 | Mapped |
| CVE-2022-26258 | D-Link DIR-820L | T1499.002 | Mapped |
| CVE-2022-29303 | SolarView Compact | T1496 | Mapped |
| CVE-2022-29464 | WSO2 Multiple Products | T1496 | Mapped |
| CVE-2023-1389 | TP-Link Archer AX21 | T1496 | Mapped |
| CVE-2023-22527 | Atlassian Confluence Data Center and Server | T1496 | Mapped |
| CVE-2023-32315 | Ignite Realtime Openfire | T1496 | Mapped |
| CVE-2023-38035 | Ivanti Sentry | T1496 | Mapped |
| CVE-2023-47565 | QNAP VioStor NVR | T1496 | Mapped |
| CVE-2023-49897 | FXC AE1021, AE1021PE | T1496 | Mapped |
| CVE-2024-23692 | Rejetto HTTP File Server | T1496 | Mapped |
| CVE-2025-4632 | Samsung MagicINFO 9 Server | T1496 | Mapped |