PB-015: Active Exploitation

Document Control

Attribute	Value	Date
Document Name	PB-015: Active Exploitation	[Enter date]
Version	[Enter version number]	[Enter date]
Owner	[Enter owner/team]	[Enter date]
Status	[Draft/Approved/Retired]	[Enter date]
Next Review Date	[Enter next review date]	[Enter date]
Approvals	[Enter approver(s)]	[Enter date]
Change Summary	Initial creation	[Enter date]

1. Purpose & Scope

Purpose:

Provide a structured response for confirmed vulnerability exploitation. Use this playbook to validate exploitation evidence, scope affected assets, preserve evidence, contain attacker access, eradicate persistence, and coordinate recovery.
Scope:

Applies when exploitation is confirmed against organisational systems, applications, endpoints, cloud workloads, SaaS platforms, network services, exposed infrastructure, or third-party managed environments.

2. Incident Identification & Criteria

Incident Type: Active Exploitation

Trigger Conditions:

Initiate this playbook when any of the following occur:

Successful exploitation is confirmed by telemetry, forensic evidence, vendor notification, or responder validation
Exploit activity results in code execution, web shell deployment, credential access, persistence, data access, privilege escalation, or lateral movement
Threat actor activity is observed on an asset affected by a known vulnerability or misconfiguration
Active exploitation is confirmed after vulnerability or zero-day response triage

Severity Levels:

Severity	Description
Sev 3	Exploitation confirmed on a low-impact asset with no persistence, data access, or follow-on activity observed
Sev 2	Exploitation confirmed on one or more non-critical assets with limited attacker activity
Sev 1	Exploitation confirmed on critical, internet-facing, privileged, production, or sensitive-data systems
Sev 0	Widespread exploitation, ongoing attacker control, major business impact, or confirmed compromise of critical infrastructure

3. Roles & Responsibilities

Incident Commander: Sets severity, coordinates response, approves containment, and owns escalation decisions.
Technical Lead: Directs investigation, containment, eradication, and recovery across affected teams.
Incident Responder / Forensic Analyst: Validates exploitation, preserves evidence, scopes affected assets, and analyses attacker activity.
Communications Lead: Coordinates internal, executive, legal, customer, vendor, and stakeholder communications.
Other Roles:
- Vulnerability Management Team: Confirms vulnerability details, affected versions, remediation options, and patch status.
- System / Application Owners: Support asset validation, service impact analysis, containment, patching, and recovery.
- Cloud / Network / Platform Teams: Support infrastructure containment, logging, segmentation, and provider coordination.
- Legal / Compliance: Assesses customer, regulatory, contractual, or law enforcement obligations.

4. Initial Actions

Immediate Steps:
- Validate that exploitation was successful, not merely attempted.
  - 📘 RB-TRIAGE-007: Active Exploitation Validation
- Triage associated endpoint, identity, cloud, or web alerts as applicable.
- Identify affected asset, vulnerability, exploit path, first observed time, and whether exploitation is ongoing.
- Preserve evidence before disruptive containment where safe.
- Engage IR leadership, system owners, application owners, platform teams, and vulnerability management.
  - 📘 SOP-001: Paging an Engineering Team's On-Call
Decision Point:
- If exploitation is not confirmed → continue under PB-017: Vulnerability Response or PB-018: Zero-Day Response, as applicable.
- If exploitation is confirmed → continue this playbook and begin containment planning.
- If attacker activity is ongoing → contain affected access paths in parallel with evidence preservation.

5. Investigation & Analysis

Common Failure Modes:

Treating attempted exploitation as confirmed exploitation without evidence

Containing before preserving volatile evidence when safe preservation is possible

Focusing only on patching while missing persistence or follow-on attacker activity

Failing to scope additional affected assets

Restoring systems before validating exploit path closure

Evidence Collection:
- Collect host, process, command-line, file, persistence, and endpoint telemetry for affected systems.
  - 📘 RB-EVIDENCE-002: Host-Based Log Acquisition
- Collect identity, authentication, MFA, session, and privileged access telemetry.
  - 📘 RB-EVIDENCE-003: Identity & Authentication Log Acquisition
- Collect cloud control plane, workload snapshot, or web application logs where relevant.
Analysis Steps:
- Analyse exploitation timeline, exploit vector, payloads, attacker actions, and post-exploitation behaviour.
  - 📘 RB-ANALYSIS-034: Exploitation Activity Analysis
- Identify initial and additional affected assets.
  - 📘 RB-ANALYSIS-035: Affected Asset Identification
- Verify the vulnerability exploited, affected versions, exposure path, and whether exploitation is repeatable.
  - 📘 RB-ANALYSIS-041: Exploitation Verification
- Analyse process trees, commands, scripts, LOLBins, malware, persistence, and outbound traffic as applicable.
- Assess whether sensitive data was accessed, staged, or exfiltrated.
  - 📘 RB-ANALYSIS-019: Data Staging Investigation
  - 📘 RB-ANALYSIS-021: Sensitive Data Impact Assessment
Decision Point: Run the post-detection phases (Analysis → Recovery) of any relevant sibling playbook concurrently alongside this one based on what was observed:
- If malware or suspicious execution is identified → execute PB-003: Endpoint Malware Infection or PB-011: Suspicious Execution concurrently.
- If account compromise or credential abuse is identified → execute PB-004: Account Takeover concurrently.
- If data exposure, staging, or exfiltration is identified → execute PB-005: Data Exfiltration concurrently.
- If cloud compromise is identified → execute PB-007: Cloud Compromise concurrently.
- If web application compromise is identified → execute PB-008: Web Application Attack concurrently.
- If privilege escalation is identified → execute PB-009: Privilege Escalation concurrently.
- If lateral movement is identified → execute PB-010: Lateral Movement concurrently.
- If exploitation is widespread or business-critical → execute PB-019: Major Security Incident Management concurrently.

6. Containment, Eradication & Recovery

Containment Actions:
- Reduce or block exploitation paths using network, application, cloud, access, and exposure controls.
  - 📘 RB-CONTAIN-012: Exploitation Surface Containment
- Isolate affected hosts, workloads, or application access where compromise is confirmed or integrity is uncertain.
- Lock compromised accounts and revoke sessions/tokens where identity abuse is suspected.
  - 📘 RB-CONTAIN-001: Account Lockdown
  - 📘 RB-CONTAIN-005: Session & Token Revocation
- Apply vulnerability exposure reduction controls if the exploited weakness remains present.
  - 📘 RB-CONTAIN-014: Vulnerability Exposure Reduction
Eradication Steps:
- Remove web shells, malware, persistence, unauthorised accounts, attacker tooling, modified files, exposed secrets, and backdoors.
- Patch, reconfigure, disable, or replace vulnerable components once containment is stable.
- Rotate credentials, keys, certificates, and tokens exposed through exploitation.
Recovery Steps:
- Rebuild or restore compromised systems where integrity cannot be validated.
  - 📘 RB-RECOVERY-002: Clean System Rebuild
- Coordinate staged restoration of affected services and dependencies.
  - 📘 RB-RECOVERY-001: Recovery & Restoration Coordination
- Validate remediation and confirm the exploited vulnerability is no longer exploitable.
  - 📘 RB-RECOVERY-007: Vulnerability Remediation Validation

7. Communication & Escalation

Internal Communication:
- Notify security leadership, vulnerability management, system owners, application owners, platform owners, and impacted business teams.
- Use geo handoff where the incident spans shifts.
  - 📘 SOP-002: Incident Handoff Between Geos
External Communication:
- Coordinate customer, regulator, legal, executive, vendor, provider, and law enforcement communications through approved processes.
  - 📘 SOP-003: Escalation, Legal & Executive Communications
  - 📘 SOP-005: Vendor Communication During a Security Incident

Escalation Criteria:

Condition	Escalate To
Malware or suspicious execution identified	PB-003: Endpoint Malware Infection / PB-011: Suspicious Execution
Account compromise or credential abuse identified	PB-004: Account Takeover
Data exposure, staging, or exfiltration identified	PB-005: Data Exfiltration
Cloud compromise identified	PB-007: Cloud Compromise
Web application compromise identified	PB-008: Web Application Attack
Privilege escalation identified	PB-009: Privilege Escalation
Lateral movement identified	PB-010: Lateral Movement
Widespread exploitation or major business impact	PB-019: Major Security Incident Management

8. Post-Incident Activities

Lessons Learned:
- Conduct a PIR covering vulnerability exposure, detection timing, attacker actions, containment speed, remediation quality, and recovery decisions.
- Review patch management, exposure management, detection coverage, logging, segmentation, and asset inventory gaps.
Documentation Updates:
- Update detections, vulnerable asset inventory, remediation records, runbooks, and this playbook based on lessons learned.

PB-015: Active Exploitation

Document Control

1. Purpose & Scope

2. Incident Identification & Criteria

3. Roles & Responsibilities

4. Initial Actions

5. Investigation & Analysis

6. Containment, Eradication & Recovery

7. Communication & Escalation

8. Post-Incident Activities

9. References & Linked Resources

10. Appendices

Contributor